Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:npm/crypto-js@4.0.0

Type npm

Namespace

Name crypto-js

Version 4.0.0

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version 4.2.0

Latest_non_vulnerable_version 4.2.0

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-hjvn-rwwm-qqh5

vulnerability_id VCID-hjvn-rwwm-qqh5

summary

Insufficient Entropy
An attacker is able to guess generated digits due to insufficient entropy.

references

reference_url	https://github.com/brix/crypto-js/issues/256
reference_id
reference_type
scores
url	https://github.com/brix/crypto-js/issues/256

fixed_packages

url	pkg:npm/crypto-js@3.2.1
purl	pkg:npm/crypto-js@3.2.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/crypto-js@3.2.1

url	pkg:npm/crypto-js@4.0.0
purl	pkg:npm/crypto-js@4.0.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/crypto-js@4.0.0

aliases GMS-2020-4

risk_score null

exploitability 0.5

weighted_severity 0.0

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hjvn-rwwm-qqh5

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:npm/crypto-js@4.0.0

Package Instance