Insecure Encryption Affecting parsel package, versions >=0.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PARSEL-543172
- published 22 Jan 2020
- disclosed 22 Jan 2020
- credit Salesforce Product Security
Introduced: 22 Jan 2020
CVE-2020-6763 Open this link in a new tabHow to fix?
There is no fixed version for parsel.
Overview
parsel is a library that allows you to encrypt and decrypt data with a given key.
Affected versions of this package are vulnerable to Insecure Encryption. It contains a weak key derivation function, in which a key of arbitrary length is run through one round of SHA256 to gain key material of the correct length. This allows for the use of weak key material without appropriate key stretching.
References
CVSS Scores
version 3.1