Description (CNA)
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NodeJS / Node | affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.*; affected 15.0 before 15.*; affected 16.0 before 16.20.1; affected 17.0 before 17.*; affected 18.0 before 18.16.1; affected 19.0 before 19.*; affected 20.0 before 20.3.1 |
CWE
No CWE identifiers supplied.
References
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
- https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.