diff --git a/.github/workflows/monorepo-validate.yaml b/.github/workflows/monorepo-validate.yaml index 10a73f9a3..d2c3c1615 100644 --- a/.github/workflows/monorepo-validate.yaml +++ b/.github/workflows/monorepo-validate.yaml @@ -19,23 +19,6 @@ jobs: if: steps.cache.outputs.cache-hit != 'true' - run: yarn run compliance:licenses - audit: - name: Security Audit - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: actions/cache@v2 - id: cache - with: - path: '**/node_modules' - key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }} - - uses: actions/setup-node@v1 - with: - node-version: '12.x' - - run: yarn install - if: steps.cache.outputs.cache-hit != 'true' - - run: yarn run compliance:audit - lint: name: Lint runs-on: ubuntu-latest diff --git a/package.json b/package.json index 2ddfaa9a8..d97dea05d 100644 --- a/package.json +++ b/package.json @@ -30,8 +30,7 @@ "test:addons-rose": "cd addons/rose && yarn test", "test:ui-admin": "cd ui/admin && yarn test", "test:ui-desktop": "cd ui/desktop && yarn test", - "compliance:audit": "bash ./scripts/yarn-audit.sh", - "precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test", + "precommit": "yarn compliance:licenses && yarn lint && yarn test", "commit": "git-cz", "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Python-2.0;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2;cycle@1.0.3'", "doc:toc": "doctoc README.md" diff --git a/scripts/yarn-audit.sh b/scripts/yarn-audit.sh deleted file mode 100644 index 4b5bd702c..000000000 --- a/scripts/yarn-audit.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/usr/bin/env bash - -# Workaround to suppress yarn audit report for issues without known resolutions. -# Audit level: Moderate -# https://github.com/yarnpkg/yarn/issues/6669 - -set -u - -set +e -output=$(yarn audit --level=moderate --json) -result=$? -set -e - -if [ $result -eq 0 ]; then - # everything is fine - exit 0 -fi - -if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then - echo - echo Ignorning known vulnerabilities - exit 0 -fi - -echo -echo Security vulnerabilities were found that were not ignored -echo -echo Check to see if these vulnerabilities apply to production -echo and/or if they have fixes available. If they do not have -echo fixes and they do not apply to production, you may ignore them -echo -echo To ignore these vulnerabilities, run: -echo -echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues" -echo -echo and commit the yarn-audit-known-issues file - -exit "$result" diff --git a/ui/desktop/electron-app/src/helpers/app-updater.js b/ui/desktop/electron-app/src/helpers/app-updater.js index 1898c6ac6..c27ee75e5 100644 --- a/ui/desktop/electron-app/src/helpers/app-updater.js +++ b/ui/desktop/electron-app/src/helpers/app-updater.js @@ -33,12 +33,12 @@ const findLatestVersion = (url) => { // Find zip archive for update const findUpdateArchive = (version) => { - const url = `${releasesUrl}boundary-desktop_${version}/boundary-desktop_${version}_darwin_amd64.zip`; + const url = `${releasesUrl}${version}/boundary-desktop_${version}_darwin_amd64.zip`; return new Promise((resolve, reject) => { https.get(url, (response) => { if (response.statusCode === 403) reject({ message: 'Archive not available' }); - response.on('end', () => resolve(url)); + if (response.statusCode === 200) resolve(url); response.on('error', (err) => reject(err)); }); }); @@ -136,7 +136,10 @@ module.exports = { latestVersion = semver.coerce(latestVersion); } - // Update not available - do nothing + /** + * Update not available - do nothing + * lte(v1, v2): v1 <= v2 + **/ if (semver.lte(latestVersion, currentVersion)) { if (!suppressNoUpdatePrompt) displayInfoPrompt(); return; diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues deleted file mode 100644 index 74ce49273..000000000 --- a/yarn-audit-known-issues +++ /dev/null @@ -1,14 +0,0 @@ -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}