~ / search / GHSA-rq8g-5pc5-wrhr

GHSA-rq8g-5pc5-wrhr

Insufficient Entropy in cryptiles

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-1000620

Packages

EcosystemPackageAffectedFixed in
npm cryptiles >= 4.0.0, < 4.1.2 4.1.2
npm cryptiles >= 3.1.0, < 3.1.3 3.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `cryptiles` prior to 4.1.2 are vulnerable to Insufficient Entropy. The `randomDigits()` method does not provide sufficient entropy and its generates digits that are not evenly distributed. ## Recommendation Upgrade to version 4.1.2. The package is deprecated and has been moved to `@hapi/cryptiles` and it is strongly recommended to use the maintained package.

References

External links from the advisory. They lead to third-party sites.