What is GHSA-qg3g-2mgh-33j8?

GHSA-qg3g-2mgh-33j8 is a security advisory published by GitHub Security Advisories with Critical severity. Sensitive Data Exposure in msrcrypto

Which CVE IDs does GHSA-qg3g-2mgh-33j8 cover?

GHSA-qg3g-2mgh-33j8 covers the following CVE IDs: CVE-2018-8319. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qg3g-2mgh-33j8?

GHSA-qg3g-2mgh-33j8 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-qg3g-2mgh-33j8?

GHSA-qg3g-2mgh-33j8 affects 1 product, including: npm/msrcrypto:\u003c 1.4.1.

GHSA-qg3g-2mgh-33j8CriticalCVSS 9.8

Sensitive Data Exposure in msrcrypto

Vendor

GitHub Security Advisories

Published

September 10, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-8319 →

📋 Description

Versions of msrcrypto prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability.

Recommendation

Upgrade to version 1.4.1 or later.

🎯 Affected products1

npm/msrcrypto:< 1.4.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2018-8319
https://github.com/advisories/GHSA-qg3g-2mgh-33j8
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319
https://www.npmjs.com/advisories/1112
http://www.securityfocus.com/bid/104655
http://www.securitytracker.com/id/1041268