{"answers":{"affected":"2 open source packages ship an affected version, including keypair. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-41117 in the wild and no public exploit code.","fix":"Upgrade keypair to 1.0.4 or later.","what":"CVE-2021-41117 is a high-severity vulnerability in juliangruber keypair, published on 11 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-41117 and fix it if it is affected.\n\nWhat it is: CVE-2021-41117 is a high-severity vulnerability in juliangruber keypair, published on 11 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-41117 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- keypair (npm): affected all versions; fixed in 1.0.4\n- keypair (npm): affected all versions; fixed in 1.0.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-41117/ (Markdown: https://insights.sbomify.com/CVE-2021-41117/index.md)","id":"CVE-2021-41117","markdown":"https://insights.sbomify.com/CVE-2021-41117/index.md","name":"CVE-2021-41117","record":{"aliases":["GHSA-3f99-hvg4-qjwj"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript RSA key generator","requires_auth":"none","summary":"The library generates identical RSA keys due to flawed random number generation, allowing attackers to predict keys and compromise SSH security.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"keypair","vendor":"keypair_project"}],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-335","name":"Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)"}],"description":"keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing from other libraries where possible, including node-forge. An issue was discovered where this library was generating identical RSA keys used in SSH. This would mean that the library is generating identical P, Q (and thus N) values which, in practical terms, is impossible with RSA-2048 keys. Generating identical values, repeatedly, usually indicates an issue with poor random number generation, or, poor handling of CSPRNG output. Issue 1: Poor random number generation (`GHSL-2021-1012`). The library does not rely entirely on a platform provided CSPRNG, rather, it uses it's own counter-based CMAC approach. Where things go wrong is seeding the CMAC implementation with \"true\" random data in the function `defaultSeedFile`. In order to seed the AES-CMAC generator, the library will take two different approaches depending on the JavaScript execution environment. In a browser, the library will use [`window.crypto.getRandomValues()`](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L971). However, in a nodeJS execution environment, the `window` object is not defined, so it goes down a much less secure solution, also of which has a bug in it. It does look like the library tries to use node's CSPRNG when possible unfortunately, it looks like the `crypto` object is null because a variable was declared with the same name, and set to `null`. So the node CSPRNG path is never taken. However, when `window.crypto.getRandomValues()` is not available, a Lehmer LCG random number generator is used to seed the CMAC counter, and the LCG is seeded with `Math.random`. While this is poor and would likely qualify in a security bug in itself, it does not explain the extreme frequency in which duplicate keys occur. The main flaw: The output from the Lehmer LCG is encoded incorrectly. The specific [line][https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008] with the flaw is: `b.putByte(String.fromCharCode(next \u0026 0xFF))` The [definition](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L350-L352) of `putByte` is `util.ByteBuffer.prototype.putByte = function(b) {this.data += String.fromCharCode(b);};`. Simplified, this is `String.fromCharCode(String.fromCharCode(next \u0026 0xFF))`. The double `String.fromCharCode` is almost certainly unintentional and the source of weak seeding. Unfortunately, this does not result in an error. Rather, it results most of the buffer containing zeros. Since we are masking with 0xFF, we can determine that 97% of the output from the LCG are converted to zeros. The only outputs that result in meaningful values are outputs 48 through 57, inclusive. The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion. When it is not, the bytes are 0 through 9. In summary, there are three immediate concerns: 1. The library has an insecure random number fallback path. Ideally the library would require a strong CSPRNG instead of attempting to use a LCG and `Math.random`. 2. The library does not correctly use a strong random number generator when run in NodeJS, even though a strong CSPRNG is available. 3. The fallback path has an issue in the implementation where a majority of the seed data is going to effectively be zero. Due to the poor random number generation, keypair generates RSA keys that are relatively easy to guess. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":"2022-05-15","github_poc":1,"max_poc_stars":8,"metasploit":0,"nuclei":0,"refs":[{"date":"2022-05-15T06:56:53Z","kind":"github_poc","ref":"https://github.com/badkeys/keypairvuln","stars":8,"title":"Private keys generated with vulnerable keypair versions (CVE-2021-41117)"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Insecure random number generation","id":"CVE-2021-41117","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"weak_cryptography","year":"2021"},"n_packages":2,"n_references":2,"next":{"headline":"ReDoS in DynamicPageList3","id":"CVE-2021-41118"},"packages":[{"ecosystem":"npm","fixed":["1.0.4"],"introduced":["0"],"last_affected":[],"package":"keypair","purl":null,"source":"GHSA-3f99-hvg4-qjwj"},{"ecosystem":"npm","fixed":["1.0.4"],"introduced":["0"],"last_affected":[],"package":"keypair","purl":"pkg:npm/keypair","source":"GHSA-3f99-hvg4-qjwj"}],"prev":{"headline":"Command injection in composer on Windows","id":"CVE-2021-41116"},"products":["keypair"],"published":"2021-10-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["juliangruber"]},"summary":"The library generates identical RSA keys due to flawed random number generation, allowing attackers to predict keys and compromise SSH security.","url":"https://insights.sbomify.com/CVE-2021-41117/"}