Use of a broken or risky cryptographic algorithm in crypto-js - CVE-2023-46233

Vulnerability identifier: #VU83993

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46233

CWE-ID: CWE-327

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of a weak PBKDF2 algorithm. A remote attacker can gain access to sensitive information.

crypto-js
IBM Cloud Pak for Watson AIOps
Anolis OS
Ubuntu
IBM Automation Decision Services
IBM Process Mining
IBM Spectrum Control
IBM Cloud Pak for Business Automation
libjs-cryptojs (Ubuntu package)
dotnet-targeting-pack-6.0
dotnet-runtime-6.0
aspnetcore-runtime-6.0
aspnetcore-targeting-pack-6.0
dotnet-hostfxr-6.0
dotnet-apphost-pack-6.0
dotnet-host
netstandard-targeting-pack-2.1
dotnet-templates-6.0
dotnet-sdk-6.0-source-built-artifacts
dotnet-sdk-6.0
dotnet
Jazz Foundation

Install updates from vendor's website.

crypto-js - update to 4.2.0
IBM Automation Decision Services - update to 23.0.1 IF005
libjs-cryptojs (Ubuntu package) - addressed in versions Ubuntu Pro, 3.1.2+dfsg-2ubuntu0.20.04.1
IBM Process Mining - update to 1.14.3
IBM Spectrum Control - update to 5.4.11
dotnet-targeting-pack-6.0 - update to 6.0.26-1.0.1
dotnet-runtime-6.0 - update to 6.0.26-1.0.1
aspnetcore-runtime-6.0 - update to 6.0.26-1.0.1
aspnetcore-targeting-pack-6.0 - update to 6.0.26-1.0.1
dotnet-hostfxr-6.0 - update to 6.0.26-1.0.1
dotnet-apphost-pack-6.0 - update to 6.0.26-1.0.1
dotnet-host - update to 6.0.26-1.0.1
netstandard-targeting-pack-2.1 - update to 6.0.126-1.0.1
dotnet-templates-6.0 - update to 6.0.126-1.0.1
dotnet-sdk-6.0-source-built-artifacts - update to 6.0.126-1.0.1
dotnet-sdk-6.0 - update to 6.0.126-1.0.1
dotnet - update to 6.0.126-1.0.1
Jazz Foundation - addressed in versions 7.0.2.0.32, 7.0.3.0.11, 7.1.0.0.1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.27, 23.0.1.5

• https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf
• https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a
• https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html

• Use of a weak cryptographic algorithm in crypto-js
• Use of a broken or risky cryptographic algorithm in IBM Spectrum Control
• Multiple vulnerabilities in IBM Automation Decision Services
• IBM Process Mining update for crypto-js
• IBM Cloud Pak for Watson AIOps update for crypto-js
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Ubuntu update for cryptojs
• IBM Jazz Foundation update for Brix crypto-js
• Anolis OS update for dotnet6.0