Homepage
About Snyk

@dfinity/auth-client@0.20.2 vulnerabilities

JavaScript and TypeScript library to provide a simple integration with an IC Internet Identity

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @dfinity/auth-client package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

@dfinity/auth-client is a JavaScript and TypeScript library to provide a simple integration with an IC Internet Identity

Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) due to the use of an insecure seed for key pair generation in the Ed25519KeyIdentity.generate function. An attacker can compromise the private key of an identity, potentially leading to loss of funds associated with the principal on ledgers or loss of access to a canister where this principal is the controller.

Note:

This is only exploitable if the optional parameter to provide a 32 byte seed value is not used, leading to the generation of a key pair with an insecure seed.

How to fix Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)?

Upgrade @dfinity/auth-client to version 1.0.1 or higher.

>=0.20.0-beta.0 <1.0.1
Go back to all versions of this package