CVE-2022-35255
Fixed in a distro release EPSS 2%CVSS 9.1
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Products: NodeJS Node
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux:8 | nodejs | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux:8 | nodejs-devel | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux:8 | nodejs-devel | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs-docs | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs-docs | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.9.1-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.17.1-1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.19-1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.19-2.module_el8.6.0+3261+490666b3 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | npm | 1:8.19.1-1.18.9.1.1.module_el8.7.0+3343+ea2b7901 |
| AlmaLinux:8 | npm | 1:8.15.0-1.16.17.1.1.module_el8.6.0+3328+2e4711d7 |
| AlmaLinux:9 | nodejs | 1:16.17.1-1.el9_0 |
| AlmaLinux:9 | nodejs-docs | 1:16.17.1-1.el9_0 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.17.1-1.el9_0 |
| AlmaLinux:9 | nodejs-libs | 1:16.17.1-1.el9_0 |
| AlmaLinux:9 | npm | 1:8.15.0-1.16.17.1.1.el9_0 |
| Alpine:v3.15 | nodejs | 16.17.1-r0 |
| Alpine:v3.16 | nodejs | 16.17.1-r0 |
| Alpine:v3.17 | nodejs | 16.17.1-r0 |
| Alpine:v3.18 | nodejs | 16.17.1-r0 |
| Alpine:v3.19 | nodejs | 16.17.1-r0 |
| Alpine:v3.20 | nodejs | 16.17.1-r0 |
| Alpine:v3.21 | nodejs | 16.17.1-r0 |
| Alpine:v3.22 | nodejs | 16.17.1-r0 |
| Alpine:v3.23 | nodejs | 16.17.1-r0 |
| Alpine:v3.24 | nodejs | 16.17.1-r0 |
| Debian:11 | nodejs | 12.22.12~dfsg-1~deb11u3 |
| Debian:12 | nodejs | 18.10.0+dfsg-1 |
| Debian:13 | nodejs | 18.10.0+dfsg-1 |
| Debian:14 | nodejs | 18.10.0+dfsg-1 |
| Red Hat:enterprise_linux:8 | nodejs | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | nodejs | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:8 | nodejs-debuginfo | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:8 | nodejs-debuginfo | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | nodejs-debugsource | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | nodejs-debugsource | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:8 | nodejs-devel | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | nodejs-devel | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:8 | nodejs-docs | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:8 | nodejs-docs | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | nodejs-full-i18n | 1:18.9.1-1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:8 | nodejs-full-i18n | 1:16.17.1-1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | nodejs-nodemon | 0:2.0.19-1.module+el8.7.0+16061+0a247725 |
| Red Hat:enterprise_linux:8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+16240+7ca51420 |
| Red Hat:enterprise_linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat:enterprise_linux:8 | nodejs-packaging | 0:25-1.module+el8.5.0+10992+fac5fe06 |
| Red Hat:enterprise_linux:8 | nodejs-packaging-bundler | 0:2021.06-4.module+el8.7.0+15582+19c314fa |
| Red Hat:enterprise_linux:8 | npm | 1:8.15.0-1.16.17.1.1.module+el8.6.0+16848+a483195a |
| Red Hat:enterprise_linux:8 | npm | 1:8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b |
| Red Hat:enterprise_linux:9 | nodejs | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | nodejs-debuginfo | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | nodejs-debugsource | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | nodejs-docs | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | nodejs-full-i18n | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | nodejs-libs | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | nodejs-libs-debuginfo | 1:16.17.1-1.el9_0 |
| Red Hat:enterprise_linux:9 | npm | 1:8.15.0-1.16.17.1.1.el9_0 |
| Rocky Linux:8 | nodejs | 1:16.17.1-1.module+el8.6.0+1046+80feca58 |
| Rocky Linux:8 | nodejs | 1:18.9.1-1.module+el8.7.0+1072+5b168780 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.19-1.module+el8.7.0+1072+5b168780 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+1003+ae94235a |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+1046+80feca58 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.6.0+1046+80feca58 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.5.0+702+221f14e6 |
| Rocky Linux:9 | nodejs | 1:16.17.1-1.el9_0 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs16 | 16.17.1-8.12.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 12 | nodejs18 | 18.13.0-8.3.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP3 | nodejs16 | 16.17.1-150300.7.12.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs16 | 16.17.1-150400.3.9.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP4 | nodejs18 | 18.13.0-150400.9.3.1 |
| openSUSE:Leap 15.3 | nodejs16 | 16.17.1-150300.7.12.1 |
| openSUSE:Leap 15.4 | nodejs16 | 16.17.1-150400.3.9.1 |
| openSUSE:Leap 15.4 | nodejs18 | 18.13.0-150400.9.3.1 |
| openSUSE:Leap 15.5 | nodejs18 | 18.13.0-150400.9.3.1 |
| openSUSE:Tumbleweed | nodejs16 | 16.17.1-1.1 |
| openSUSE:Tumbleweed | nodejs18 | 18.10.0-1.1 |