NVD Vulnerability Detail

CVE-2020-36732

Summary	The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Publication Date	June 12, 2023, 11:15 a.m.
Registration Date	June 12, 2023, 4 p.m.
Last Update	Nov. 21, 2024, 2:30 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:crypto-js_project:crypto-js::::::::					3.2.1

Related information, measures and tools

No	URL	タグ
1	https://github.com/brix/crypto-js/compare/3.2.0...3.2.1	Release Notes
2	https://github.com/brix/crypto-js/compare/3.2.0...3.2.1	Release Notes
3	https://github.com/brix/crypto-js/issues/254	Issue Tracking Vendor Advisory
4	https://github.com/brix/crypto-js/issues/254	Issue Tracking Vendor Advisory
5	https://github.com/brix/crypto-js/issues/256	Issue Tracking Patch Vendor Advisory
6	https://github.com/brix/crypto-js/issues/256	Issue Tracking Patch Vendor Advisory
7	https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b	Patch
8	https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b	Patch
9	https://security.netapp.com/advisory/ntap-20230706-0003/
10	https://security.netapp.com/advisory/ntap-20230706-0003/
11	https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472	Third Party Advisory
12	https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-330	不十分なランダム値の使用	https://cwe.mitre.org/data/definitions/330.html

JVN Vulnerability Information

crypto-js project の crypto-js における不十分なランダム値の使用に関する脆弱性

Title	crypto-js project の crypto-js における不十分なランダム値の使用に関する脆弱性
Summary	crypto-js project の crypto-js には、不十分なランダム値の使用に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	June 12, 2023, midnight
Registration Date	Nov. 30, 2023, 5:14 p.m.
Last Update	Nov. 30, 2023, 5:14 p.m.

Affected System

crypto-js project

crypto-js 3.2.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-36732	https://www.cve.org/CVERecord?id=CVE-2020-36732
National Vulnerability Database (NVD)
2	CVE-2020-36732	https://nvd.nist.gov/vuln/detail/CVE-2020-36732

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-330	https://cwe.mitre.org/data/definitions/330.html

その他

No	Name	URL
関連文書
1	github.com (3.2.0...3.2.1)	https://github.com/brix/crypto-js/compare/3.2.0...3.2.1
2	github.com (e4ac157d8b75b962d6538fc0b996e5d4d5a9466b)	https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b
3	github.com (issues/254)	https://github.com/brix/crypto-js/issues/254
4	github.com (issues/256)	https://github.com/brix/crypto-js/issues/256
5	security.netapp.com (ntap-20230706-0003)	https://security.netapp.com/advisory/ntap-20230706-0003/
6	security.snyk.io (SNYK-JS-CRYPTOJS-548472)	https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472

Change Log

No	Changed Details	Date of change
1	[2023年11月30日] 掲載	Nov. 30, 2023, 5:14 p.m.