Veracode Vulnerability DatabaseVERACODE:44452Inconsistency Between Implementation And Documented Design
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
6.6 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
31.2%
nodejs is vulnerable to Inconsistency Between Implementation and Documented Design. The vulnerability is due to generateKeys API function returned from crypto.createDiffieHellman only generates missing (or outdated) keys.This discrepancy between the documented and actual behavior of the API allows an attacker to exploit the inconsistency, potentially leading to security breaches in applications that use the Diffie-Hellman method for key generation and expect both private and public keys to be generated as per the documentation.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nodejs:sid | eq | 12.19.0~dfsg-1 | |
| nodejs:sid | eq | 12.19.0~dfsg-1 | |
| nodejs:buster | eq | 10.24.0~dfsg-1~deb10u1 | |
| nodejs:buster | eq | 10.21.0~dfsg-1~deb10u1 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
6.6 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
31.2%