The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".
The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs | Aug 3, 2023 | Jul 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-debuginfoUpgrade v8-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-libs | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade npm | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 28, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-native-image-llvm-backendUpgrade npmUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-jdkUpgrade nodejs-develUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-pythonUpgrade nodejs-docsUpgrade nodejsUpgrade graalvm-community-17-native-imageUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-polyglotUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-nodejsUpgrade nodejs-full-i18nUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-tools | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-libsUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade npmUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoNo solution existsUpgrade nodejs-libs-debuginfoUpgrade nodejs-nodemon | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-devel | Mar 5, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade corepack14Upgrade nodejs14-docsUpgrade npm18Upgrade nodejs16Upgrade npm14Upgrade npm12Upgrade corepack16Upgrade nodejs16-docsUpgrade npm16Upgrade nodejs18-develUpgrade nodejs14-develUpgrade nodejs12-docsUpgrade nodejs18Upgrade corepack18Upgrade nodejs18-docsUpgrade nodejs16-develUpgrade nodejs12-develUpgrade nodejs12Upgrade nodejs14 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode64Upgrade nodejs-docUpgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade libnode72Upgrade libnode108Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro) | Apr 17, 2024 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub