chore: Remove yarn audit check
Json output option for yarn audit is broken: https://github.com/yarnpkg/yarn/issues/7404
This commit is contained in:
3 files changed
+1
-54
No files matched your search
+1
-2
@@ -30,8 +30,7 @@
|
||||
"test:addons-rose": "cd addons/rose && yarn test",
|
||||
"test:ui-admin": "cd ui/admin && yarn test",
|
||||
"test:ui-desktop": "cd ui/desktop && yarn test",
|
||||
"compliance:audit": "bash ./scripts/yarn-audit.sh",
|
||||
"precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test",
|
||||
"precommit": "yarn compliance:licenses && yarn lint && yarn test",
|
||||
"commit": "git-cz",
|
||||
"compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Python-2.0;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2;cycle@1.0.3'",
|
||||
"doc:toc": "doctoc README.md"
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Workaround to suppress yarn audit report for issues without known resolutions.
|
||||
# Audit level: Moderate
|
||||
# https://github.com/yarnpkg/yarn/issues/6669
|
||||
|
||||
set -u
|
||||
|
||||
set +e
|
||||
output=$(yarn audit --level=moderate --json)
|
||||
result=$?
|
||||
set -e
|
||||
|
||||
if [ $result -eq 0 ]; then
|
||||
# everything is fine
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then
|
||||
echo
|
||||
echo Ignorning known vulnerabilities
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo
|
||||
echo Security vulnerabilities were found that were not ignored
|
||||
echo
|
||||
echo Check to see if these vulnerabilities apply to production
|
||||
echo and/or if they have fixes available. If they do not have
|
||||
echo fixes and they do not apply to production, you may ignore them
|
||||
echo
|
||||
echo To ignore these vulnerabilities, run:
|
||||
echo
|
||||
echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues"
|
||||
echo
|
||||
echo and commit the yarn-audit-known-issues file
|
||||
|
||||
exit "$result"
|
||||
@@ -1,14 +0,0 @@
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
Reference in new issue
Block a user