Use of Insufficiently Random Values Affecting npm package, versions <1:9.5.0-1.18.14.2.3.module+el8.8.0+21122+857852f8

Q: How to fix?

<p>Upgrade <code>Oracle:8</code> <code>npm</code> to version 1:9.5.0-1.18.14.2.3.module+el8.8.0+21122+857852f8 or higher.<br>This issue was patched in <code>ELSA-2023-4035</code>.</p>

Threat Intelligence

0.11% (44^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ORACLE8-NPM-5798215
published 15 Jun 2023
disclosed 25 May 2023

Report a new vulnerability Found a mistake?

Introduced: 25 May 2023

CVE-2023-31124 Open this link in a new tab CWE-330 Open this link in a new tab

How to fix?

Upgrade Oracle:8 npm to version 1:9.5.0-1.18.14.2.3.module+el8.8.0+21122+857852f8 or higher.
This issue was patched in ELSA-2023-4035.

NVD Description

Note: Versions mentioned in the description apply only to the upstream npm package and not the npm package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

Low
Availability (A)

None

Use of Insufficiently Random Values Affecting npm package, versions <1:9.5.0-1.18.14.2.3.module+el8.8.0+21122+857852f8

Severity

Based on Oracle Linux security rating