npm/cryptiles CVE-2018-1000620: critical 9.8
Insufficient Entropy in cryptiles
Action: Upgrade cryptiles to 3.1.3 or later.
npm i cryptiles@4.1.2npm i cryptiles@3.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.1.2 | - |
| 3.1.0 | 3.1.3 | - |
Fixed versions
| 4.1.2 | 3.1.3 |
Sources
- osv: GHSA-rq8g-5pc5-wrhr
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000620
- https://github.com/hapijs/cryptiles/issues/34
- https://github.com/hapijs/cryptiles/issues/35
- https://github.com/hapijs/cryptiles/commit/6bdcd0f6ee8ade96e7b30350bad39ee0c2ef0f9b
- https://github.com/hapijs/cryptiles/commit/9332d4263a32b84e76bf538d7470d01ea63fa047
- https://github.com/hapijs/cryptiles/commit/cb6bd642816e0cb8341d2b3896fd9e7c57e94f56
- https://github.com/hapijs/cryptiles
- https://github.com/nodejs/security-wg/blob/master/vuln/npm/476.json
- https://www.npmjs.com/advisories/1464
- https://www.npmjs.com/advisories/720
CVE-2018-1000620 · published · modified · JSON