crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000     times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry     standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure     since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at     1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and     collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the     impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use     SHA256 with at least 250,000 iterations. (CVE-2023-46233)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6753-1 advisory.

    Thomas Neil James Shadwell discovered that CryptoJS was using an insecure cryptographic default     configuration. A remote attacker could possibly use this issue to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0806 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.116 and .NET Runtime 7.0.16.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0805 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.116 and .NET Runtime 7.0.16.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0156 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0151 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.115 and .NET Runtime 7.0.15.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0157 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.115 and .NET Runtime 7.0.15.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0158 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3669 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3669-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     November 27, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : cryptojs     Version        : 3.1.2+dfsg-2+deb10u1     CVE ID         : CVE-2023-46233     Debian Bug     : 1055525

    Thomas Neil James Shadwell reported that cryptojs, a collection of     cryptographic algorithms implemented in JavaScript, had default PBKDF2     settings 1000 times weaker than when specified back in 1993, and 1.3M     times weaker than OWASP's current recommendations.

    The default settings are now changed to use SHA256 with 250k iterations.

    For Debian 10 buster, this problem has been fixed in version     3.1.2+dfsg-2+deb10u1.

    We recommend that you upgrade your cryptojs packages.

    For the detailed security status of cryptojs please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cryptojs

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
226865	Linux Distros Unpatched Vulnerability : CVE-2023-46233	Nessus	Misc.	critical
193904	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : CryptoJS vulnerability (USN-6753-1)	Nessus	Ubuntu Local Security Checks	critical
190500	RHEL 8 : dotnet7.0 (RHSA-2024:0806)	Nessus	Red Hat Local Security Checks	critical
190495	RHEL 9 : dotnet7.0 (RHSA-2024:0805)	Nessus	Red Hat Local Security Checks	critical
187915	RHEL 9 : .NET 6.0 (RHSA-2024:0156)	Nessus	Red Hat Local Security Checks	critical
187914	RHEL 9 : .NET 7.0 (RHSA-2024:0151)	Nessus	Red Hat Local Security Checks	critical
187913	RHEL 8 : .NET 7.0 (RHSA-2024:0157)	Nessus	Red Hat Local Security Checks	critical
187910	RHEL 8 : .NET 6.0 (RHSA-2024:0158)	Nessus	Red Hat Local Security Checks	critical
186304	Debian dla-3669 : libjs-cryptojs - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-46233

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical