GHSA-5v7r-jg9r-vq44 Insecure Cryptography Algorithm in simple-crypto-js
Attackers can break encryption and access sensitive data due to insecure AES-CBC implementation in simple-crypto-js.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5v7r-jg9r-vq44?
GHSA-5v7r-jg9r-vq44 is a vulnerability in simple-crypto-js, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.
Recommendation
Upgrade to version 2.3.0 or later.
Which versions are affected by GHSA-5v7r-jg9r-vq44?
2 open source packages ship an affected version, including simple-crypto-js.
| Package | Affected | Fixed in |
|---|---|---|
simple-crypto-js npm | All versions | 2.3.0 |
simple-crypto-js npm | All versions | 2.3.0 |
How do I fix GHSA-5v7r-jg9r-vq44?
Upgrade simple-crypto-js to 2.3.0 or later.
Is GHSA-5v7r-jg9r-vq44 being exploited?
There is no known exploitation of GHSA-5v7r-jg9r-vq44 in the wild and no public exploit code.