The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".
The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-packaging-bundler | Aug 3, 2023 | Jul 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade v8-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundler | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 28, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade graalvm-community-17-native-image-llvm-backendUpgrade nodejs-libsUpgrade graalvm-community-17-jdkUpgrade npmUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-llvmUpgrade nodejs-nodemonUpgrade graalvm-community-17-nodejs-develUpgrade graalvm-community-17-regexUpgrade nodejs-develUpgrade graalvm-community-17-python-develUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-ruby-develUpgrade nodejs-docsUpgrade nodejsUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-wasmUpgrade graalvm-community-21-jdkUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-polyglotUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-packagingUpgrade graalvm-community-17-nodejsUpgrade graalvm-community-17-tools | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | No solution existsUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejsUpgrade npmUpgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-packaging-bundler | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-develUpgrade nodejs-debuginfo | Mar 5, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade corepack18Upgrade nodejs16-develUpgrade nodejs16-docsUpgrade npm14Upgrade npm12Upgrade nodejs14-develUpgrade nodejs12-develUpgrade nodejs12-docsUpgrade nodejs18Upgrade nodejs12Upgrade npm16Upgrade corepack16Upgrade nodejs14Upgrade nodejs18-docsUpgrade nodejs18-develUpgrade npm18Upgrade nodejs14-docsUpgrade corepack14Upgrade nodejs16 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade libnode-devUpgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade libnode108Upgrade nodejs-docUpgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode64 | Apr 17, 2024 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub