← 输入框|github.com|刷新
Skip to content

Ncrack Parser is using a depracated encryption padding mechanism removed in the newest node security patch #2310

Closed

Description

@J12934

🐞 Bug report

Describe the bug

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases#nodejs-is-vulnerable-to-the-marvin-attack-timing-variant-of-the-bleichenbacher-attack-against-pkcs1-v15-padding-cve-2023-46809---medium

Expected behavior

Encryption should still work on newer versions of node

System

Screenshots / Logs

TypeError: RSA_PKCS1_PADDING is no longer supported for private decryption, this can be reverted with --security-revert=CVE-2023-46809

Additional context

Ideally this encryption should be switched to something more modern like age.
Will open up another ticket for that.

Activity

  1. added a commit that references this issue on Feb 23, 2024
  2. self-assigned this
    on Feb 23, 2024
  3. moved this from Backlog to In Progress in secureCodeBoxon Feb 23, 2024
  4. added 2 commits that reference this issue on Feb 23, 2024
  5. moved this from In Progress to Done in secureCodeBoxon Feb 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions