PT-2022-22662
CVE-2022-35255
·
Published
2022-09-23
·
Updated
2026-09-18
Description by
CVSS 3.1
9.1
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Node.js version 18
Description
A weak randomness issue exists in the WebCrypto keygen due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto keygen.cc. There are two main problems:
- The return value of EntropySource() is not checked, assuming it always succeeds, but it can fail.
- The random data returned by EntropySource() may not be cryptographically strong, making it unsuitable as keying material.
Recommendations
For Node.js version 18, consider disabling the use of WebCrypto keygen until a patch is available to address the weak randomness issue. Restrict access to the affected
EntropySource() function to minimize the risk of exploitation. Avoid using the SecretKeyGenTraits::DoKeyGen() function in src/crypto/crypto keygen.cc until the issue is resolved. Found an issue in the description? Have something to add? Feel free to write us 👾