What is GHSA-5v7r-jg9r-vq44?

GHSA-5v7r-jg9r-vq44 is a security advisory published by GitHub Security Advisories with Medium severity. Insecure Cryptography Algorithm in simple-crypto-js

Why does GHSA-5v7r-jg9r-vq44 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-5v7r-jg9r-vq44?

GHSA-5v7r-jg9r-vq44 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-5v7r-jg9r-vq44?

GHSA-5v7r-jg9r-vq44 affects 1 product, including: npm/simple-crypto-js:\u003c 2.3.0.

GHSA-5v7r-jg9r-vq44MediumCVSS 5.9Disclosed before NVD

Insecure Cryptography Algorithm in simple-crypto-js

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

April 17, 2023

📋 Description

Versions of simple-crypto-js prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.

Recommendation

Upgrade to version 2.3.0 or later.

🎯 Affected products1

npm/simple-crypto-js:< 2.3.0

🔗 References (6)

https://github.com/danang-id/simple-crypto-js/issues/12
https://robertheaton.com/2013/07/29/padding-oracle-attack/
https://snyk.io/vuln/SNYK-JS-SIMPLECRYPTOJS-544027
https://github.com/danang-id/simple-crypto-js/pull/17
https://github.com/danang-id/simple-crypto-js/commit/416584369de1dad9b21ac3fe85df0b71cf5718b2
https://github.com/advisories/GHSA-5v7r-jg9r-vq44