Summary
Nikita Skovoroda discovered that cipher-base did not properly manage
certain inputs. An attacker could possibly use this issue to manipulate
the internal state of hash functions, resulting in hash collisions,
denial of service, or other unspecified impact.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | node-cipher-base | 1.0.4-6+deb13u1ubuntu0.22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | node-cipher-base | 1.0.4-6+deb13u1ubuntu0.24.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | node-cipher-base | 1.0.4-1ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-cipher-base | 1.0.4-4ubuntu0.1~esm2 |
Vulnerabilities 1
-
Critical 9.1
Missing type checks leading to hash rewind and passing on crafted data
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
References
-
report
https://ubuntu.com/security/CVE-2025-9287