Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by entronad

    CVE-2023-46133 (GCVE-0-2023-46133)

    Vulnerability from nvd – Published: 2023-10-25 20:48 – Updated: 2024-09-10 14:08
    VLAI
    Title
    crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
    Summary
    CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-328 - Use of Weak Hash
    • CWE-916 - Use of Password Hash With Insufficient Computational Effort
    Assigner
    References
    Impacted products
    Vendor Product Version
    entronad crypto-es Affected: < 2.1.0
    		Create a notification for this product.
    entronad cryptoes Affected: 0 , < 2.1.0 (custom)
        cpe:2.3:a:entronad:cryptoes:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:39.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h"
          },
          {
            "name": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:entronad:cryptoes:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cryptoes",
            "vendor": "entronad",
            "versions": [
              {
                "lessThan": "2.1.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46133",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T13:59:03.749598Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:08:02.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "crypto-es",
          "vendor": "entronad",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a \u0027strength\u0027 or \u0027difficulty\u0027 value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-328",
              "description": "CWE-328: Use of Weak Hash",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-916",
              "description": "CWE-916: Use of Password Hash With Insufficient Computational Effort",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-25T20:49:28.040Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h"
        },
        {
          "name": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757"
        }
      ],
      "source": {
        "advisory": "GHSA-mpj8-q39x-wq5h",
        "discovery": "UNKNOWN"
      },
      "title": "crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-46133",
    "datePublished": "2023-10-25T20:48:14.285Z",
    "dateReserved": "2023-10-16T17:51:35.573Z",
    "dateUpdated": "2024-09-10T14:08:02.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2023-46133 (GCVE-0-2023-46133)

    Vulnerability from cvelistv5 – Published: 2023-10-25 20:48 – Updated: 2024-09-10 14:08
    VLAI
    Title
    crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
    Summary
    CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator (v2.0.3)
    CWE
    • CWE-328 - Use of Weak Hash
    • CWE-916 - Use of Password Hash With Insufficient Computational Effort
    Assigner
    References
    Impacted products
    Vendor Product Version
    entronad crypto-es Affected: < 2.1.0
    		Create a notification for this product.
    entronad cryptoes Affected: 0 , < 2.1.0 (custom)
        cpe:2.3:a:entronad:cryptoes:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:39.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h"
          },
          {
            "name": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:entronad:cryptoes:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cryptoes",
            "vendor": "entronad",
            "versions": [
              {
                "lessThan": "2.1.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46133",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T13:59:03.749598Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:08:02.138Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "crypto-es",
          "vendor": "entronad",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a \u0027strength\u0027 or \u0027difficulty\u0027 value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-328",
              "description": "CWE-328: Use of Weak Hash",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-916",
              "description": "CWE-916: Use of Password Hash With Insufficient Computational Effort",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-25T20:49:28.040Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/entronad/crypto-es/security/advisories/GHSA-mpj8-q39x-wq5h"
        },
        {
          "name": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/entronad/crypto-es/commit/d506677fae3d03a454b37ad126e0c119d416b757"
        }
      ],
      "source": {
        "advisory": "GHSA-mpj8-q39x-wq5h",
        "discovery": "UNKNOWN"
      },
      "title": "crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-46133",
    "datePublished": "2023-10-25T20:48:14.285Z",
    "dateReserved": "2023-10-16T17:51:35.573Z",
    "dateUpdated": "2024-09-10T14:08:02.138Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}