The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".
The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-libsUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade npm | Aug 3, 2023 | Jul 31, 2023 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-libs-debuginfo | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-libsUpgrade nodejs-develUpgrade npmUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-packaging-bundlerUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-docs | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 28, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade nodejs-full-i18nUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-llvm-toolchainUpgrade graalvm-community-17-polyglotUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-wasmUpgrade graalvm-community-17-nodejsUpgrade nodejs-packagingUpgrade graalvm-community-17-pythonUpgrade nodejs-nodemonUpgrade graalvm-community-17-jdkUpgrade npmUpgrade graalvm-community-17-python-develUpgrade graalvm-community-17-ruby-develUpgrade graalvm-community-21-native-imageUpgrade nodejs-docsUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-espresso-llvmUpgrade nodejsUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-llvmUpgrade nodejs-libsUpgrade graalvm-community-17-nodejs-develUpgrade nodejs-develUpgrade graalvm-community-17-native-image-llvm-backend | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-libsUpgrade npmUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoNo solution existsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-debugsource | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-develUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs | Mar 5, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade corepack14Upgrade nodejs16Upgrade npm18Upgrade nodejs14-docsUpgrade nodejs12-docsUpgrade npm16Upgrade nodejs18-develUpgrade nodejs14-develUpgrade corepack18Upgrade nodejs18Upgrade nodejs16-docsUpgrade nodejs16-develUpgrade nodejs12-develUpgrade nodejs12Upgrade nodejs14Upgrade npm14Upgrade npm12Upgrade corepack16Upgrade nodejs18-docs | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade nodejs-doc (Ubuntu Pro)Upgrade libnode-devUpgrade libnode108Upgrade nodejs-dev (Ubuntu Pro)Upgrade nodejsUpgrade libnode72Upgrade libnode64Upgrade nodejs (Ubuntu Pro)Upgrade nodejs-docUpgrade nodejs-legacy (Ubuntu Pro) | Apr 17, 2024 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub