The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".
The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade npm | Aug 3, 2023 | Jul 31, 2023 |
| Amazon_linux_2023 | — | Upgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-develUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-libsUpgrade nodejsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18n | Feb 17, 2025 | Jun 20, 2023 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-libs | Aug 1, 2023 | Jul 31, 2023 |
| Debian | — | Upgrade nodejs | Jan 3, 2024 | Nov 28, 2023 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Nov 28, 2023 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade graalvm-community-17-jdkUpgrade nodejs-libsUpgrade graalvm-community-17-regexUpgrade graalvm-community-17-nodejs-develUpgrade nodejs-nodemonUpgrade graalvm-community-17-javascriptUpgrade graalvm-community-17-llvmUpgrade graalvm-community-17-python-develUpgrade nodejsUpgrade graalvm-community-17-native-image-llvm-backendUpgrade graalvm-community-17-espresso-llvmUpgrade graalvm-community-17-native-imageUpgrade graalvm-community-17-espressoUpgrade graalvm-community-17-icu4jUpgrade graalvm-community-17-pythonUpgrade graalvm-community-17-ruby-develUpgrade npmUpgrade nodejs-docsUpgrade graalvm-community-21-native-imageUpgrade graalvm-community-17-wasmUpgrade nodejs-packaging-bundlerUpgrade graalvm-community-17-rubyUpgrade graalvm-community-17-toolsUpgrade graalvm-community-17-llvm-toolchainUpgrade nodejs-full-i18nUpgrade graalvm-community-21-jdkUpgrade graalvm-community-17-libpolyglotUpgrade graalvm-community-17-polyglotUpgrade nodejs-packagingUpgrade graalvm-community-17-nodejs | May 21, 2024 | Jun 20, 2023 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-packagingNo solution existsUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-docsUpgrade nodejs-libsUpgrade npmUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs | Aug 1, 2023 | Jul 31, 2023 |
| Rocky_linux | — | Upgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-full-i18n | Mar 5, 2024 | Nov 28, 2023 |
| Suse | — | Upgrade npm14Upgrade nodejs16-docsUpgrade nodejs14-develUpgrade corepack16Upgrade nodejs18-develUpgrade nodejs18-docsUpgrade nodejs12-docsUpgrade npm16Upgrade nodejs16-develUpgrade nodejs12Upgrade nodejs12-develUpgrade nodejs18Upgrade npm12Upgrade corepack18Upgrade nodejs14Upgrade nodejs16Upgrade nodejs14-docsUpgrade corepack14Upgrade npm18 | Jun 28, 2023 | Jun 27, 2023 |
| Ubuntu | — | Upgrade libnode72Upgrade libnode108Upgrade nodejs-doc (Ubuntu Pro)Upgrade nodejs-dev (Ubuntu Pro)Upgrade libnode-devUpgrade nodejsUpgrade nodejs-docUpgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro)Upgrade libnode64 | Apr 17, 2024 | Nov 28, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub