Open-source package vulnerability · npm
CVE-2023-51839: DeviceFarmer stf uses DES-ECB
criticalCVSS 3.1 9.1GHSA-7xm8-wjq7-88r5
DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.
Published Jan 29, 2024 · Updated Feb 6, 2024
Affected packages
@devicefarmer/stf
- Ecosystem
- npm
- Affected
- <= 3.6.6
- Fixed in
- No patched version yet
- Check
npm ls @devicefarmer/stf
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-51839
- https://github.com/DeviceFarmer/stf/issues/736
- https://github.com/DeviceFarmer/stf
- https://github.com/tianjk99/Cryptographic-Misuses/blob/main/CVE-2023-51839.md
- https://github.com/DeviceFarmer/stf/blob/a6b5f18941d0de5929f9c24c3ce3e9c13317a653/lib/util/vncauth.js#L35
- https://github.com/advisories/GHSA-7xm8-wjq7-88r5
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology