地图 / Use of Cryptographically Weak Pseudo-Random Number Generator in WebCrypto keygen

Use of Cryptographically Weak Pseudo-Random Number Generator in WebCrypto keygen

密码学缺陷 / Unlabeled / #1888803

厂商: Internet Bug Bounty
严重程度: 中危
赏金: $4,000
弱点: Unlabeled
研究员: @imhunternull
披露日期: 2023-04-09
资产: https://github.com/nodejs/node
CVE: CVE-2022-35255

该报告还没有中文解读。

时间线

2023-02-28报告提交
2023-04-09公开披露

阅读 HackerOne 原文 ↗作者 @imhunternull · 版权归作者与 Internet Bug Bounty 所有

同类报告

WannaCrypt “Killswitch”HackerOne · 2017-05-13 [Java] CWE-326: Query to detect weak encryption with an insufficient key sizeGitHub Security Lab · — · $4,500 sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txsetMonero · 2026-09-17 Exposed Unencrypted Telnet EndpointStarbucks · 2017-02-08 Android app does not clear end to end encryption keysNextcloud · 2021-06-16 · $100 End to end encryption public key is not properly verified on Desktop and AndroidNextcloud · 2021-09-23 · $1,500