*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Ethereum JavaScript API, middleware to talk to a ethereum node over RPC
Library home page: https://registry.npmjs.org/web3/-/web3-0.18.4.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/node_modules/web3/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-46233
### Vulnerable Library - crypto-js-3.1.8.tgzJavaScript library of crypto standards.
Library home page: https://registry.npmjs.org/crypto-js/-/crypto-js-3.1.8.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/node_modules/crypto-js/package.json
Dependency Hierarchy: - web3-0.18.4.tgz (Root Library) - :x: **crypto-js-3.1.8.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailscrypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
Publish Date: 2023-10-25
URL: CVE-2023-46233
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-46233
Release Date: 2023-10-25
Fix Resolution: crypto-js - 4.2.0
CVE-2020-36732
### Vulnerable Library - crypto-js-3.1.8.tgzJavaScript library of crypto standards.
Library home page: https://registry.npmjs.org/crypto-js/-/crypto-js-3.1.8.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/node_modules/crypto-js/package.json
Dependency Hierarchy: - web3-0.18.4.tgz (Root Library) - :x: **crypto-js-3.1.8.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Publish Date: 2023-06-12
URL: CVE-2020-36732
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2023-06-12
Fix Resolution (crypto-js): 3.2.1
Direct dependency fix Resolution (web3): 0.19.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2019-0097
### Vulnerable Library - web3-0.18.4.tgzEthereum JavaScript API, middleware to talk to a ethereum node over RPC
Library home page: https://registry.npmjs.org/web3/-/web3-0.18.4.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/node_modules/web3/package.json
Dependency Hierarchy: - :x: **web3-0.18.4.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAll versions of web3 are vulnerable to Insecure Credential Storage.
Publish Date: 2019-05-23
URL: WS-2019-0097
### CVSS 3 Score Details (3.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2019-0097
Release Date: 2019-05-23
Fix Resolution: 1.2.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2019-0075
### Vulnerable Library - web3-0.18.4.tgzEthereum JavaScript API, middleware to talk to a ethereum node over RPC
Library home page: https://registry.npmjs.org/web3/-/web3-0.18.4.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/npm7/git_sub_dep_invalid_from/node_modules/web3/package.json
Dependency Hierarchy: - :x: **web3-0.18.4.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsAll versions of web3 are vulnerable to Insecure Credential Storage
Publish Date: 2019-05-15
URL: WS-2019-0075
### CVSS 3 Score Details (3.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2019-0075
Release Date: 2019-05-15
Fix Resolution: 1.5.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.