CVE-2023-30590
7 documents7 sources
Severity
7.5HIGH
EPSS
1.0%
top 23.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 28
Latest updateApr 16
Description
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".
The documented behavior is very different from the actual behavior, and this difference could easily lead …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6