CVE-2020-36732
First published: Mon Jun 12 2023(Updated: )
The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Crypto-js Project Crypto-js | <3.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/brix/crypto-js/compare/3.2.0...3.2.1
- https://github.com/brix/crypto-js/issues/254
- https://github.com/brix/crypto-js/issues/256
- https://github.com/brix/crypto-js/pull/257/commits/e4ac157d8b75b962d6538fc0b996e5d4d5a9466b
- https://security.netapp.com/advisory/ntap-20230706-0003/
- https://security.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472
Frequently Asked Questions
What is CVE-2020-36732?
CVE-2020-36732 is a vulnerability in the crypto-js package for Node.js that generates predictable random numbers.
What is the severity of CVE-2020-36732?
The severity of CVE-2020-36732 is medium, with a CVSS score of 5.3.
How does CVE-2020-36732 affect software?
CVE-2020-36732 affects versions of the crypto-js package up to and excluding 3.2.1 for Node.js.
How can I fix CVE-2020-36732?
To fix CVE-2020-36732, update the crypto-js package to version 3.2.1 or higher.
What is CWE-330?
CWE-330 is a classification for vulnerabilities related to predictable random number generation.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/remedy
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/crypto-js project
- canonical/crypto-js project crypto-js