nodejs-september-2022-security-releases: September 23rd 2022 Security Releases
Recommendation update regarding CVE-2022-35255: Roll-out and re-issue all keys generated with WebCrypto.subtle.generateKey(). Re-evaluate the confidentiality of data encrypted with those keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Re-evaluate the confidentiality of data encrypted with the affected keys.
- Operational
Roll out and re-issue all keys generated with WebCrypto.subtle.generateKey().
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which keys and data should be treated as potentially affected?
Roll out and re-issue all keys generated with WebCrypto.subtle.generateKey(). Re-evaluate the confidentiality of any data encrypted with those keys.
What should be done if affected keys are in use?
Replace the affected keys and re-issue them. Data encrypted with those keys should be assessed for confidentiality impact.