Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Bump version for crypto-js to >= 4.0.0 (security issue)

See original GitHub issue

Bug Report

Pdfkit depends on crypto-js with the version qualifier "crypto-js": "^3.1.9-1",. This version is vulnerable to https://github.com/brix/crypto-js/issues/254

Please bump the version to >= 4.0.0 and maybe remove the “^” from version. Crypto-js does not seem to use semantic versioning correctly.

Description of the problem

From reading the vulnerability report it may seem that updating to >= 3.2.1 is sufficient. But the fix was later rolled back in 3.3.0 (see comment at end of https://github.com/brix/crypto-js/issues/256)

Warning: this may break things on older browsers.

Thanks for your time and work on this library. Much appreciated.

Code sample

Your environment

pdfkit version:
Node version:
Browser version (if applicable):
Operating System:

Issue Analytics

State:
Created 4 years ago
Reactions:3
Comments:6 (2 by maintainers)

Top GitHub Comments

1reaction

blikblumcommented, Aug 1, 2021

Done in 0.12.3

0reactions

liborm85commented, Jul 7, 2021

https://app.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472 say:

Remediation Upgrade crypto-js to version 4.0.0, 3.2.1 or higher.

Because pdfkit 0.12.1 uses crypto-js version 3.3.0 it should be safe version. Is not possible upgrade to 4.0.0, because pdfkit works in React native.

In https://github.com/brix/crypto-js changelog is critical bug only in version 3.2.0 others are without vulnerable.

Top Results From Across the Web

crypto-js@4.0.0 - Snyk Vulnerability Database

Learn more about known crypto-js 4.0.0 vulnerabilities and licenses detected. ... latest version. 4.1.1. latest non vulnerable version.

CryptoJS AES encryption with ECB mode produces different ...

As mentioned in this answer, I can use ECB mode to reverse a transformed value back into plaintext and not just compare it...

Untitled

Remove needless rcov task in Rakefile causing issue (#544964). ... Rebase to latest upstream version (from F28) - Bump release - initial rpm...

list of all node.js modules created on June 24, 2013

For `npm install ahr2` for Node and `pakmanager build` for Ender / Pakmanager. ... audit sequelize sequelizeWrapper audit_couchdb Detect security issues in ...

npmsearchfullcat_npm143.txt - GitHub

=jacoblyles 2013-08-17 0.0.0 alphabetize json node abcenter assets build ... audit sequelize sequelizeWrapper audit_couchdb Detect security issues in an ...