Inadequate Encryption Strength Affecting keypair package, versions <1.0.4


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.34% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Inadequate Encryption Strength vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-KEYPAIR-1730326
  • published12 Oct 2021
  • disclosed12 Oct 2021
  • creditKevin Jones, Ross Wheeler, Dan Suceava

Introduced: 12 Oct 2021

CVE-2021-41117  (opens in a new tab)
CWE-326  (opens in a new tab)

How to fix?

Upgrade keypair to version 1.0.4 or higher.

Overview

keypair is a Generate a RSA PEM key pair from pure JS

Affected versions of this package are vulnerable to Inadequate Encryption Strength. A bug in the pseudo-random number generator allows for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim.

CVSS Scores

version 3.1