CVE-2024-16319.1CriticalCWE-321

CVE-2024-1631: agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`

Internet Computer · agent-js

Vendor fix available · Affected: Internet Computer agent-js · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.9%probability of exploitation in the next 30 days

59th percentile

050100

Higher than 59% of scored CVEs

9.1CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32 byte seed value, which will then be used as the secret key. When no seed value is provided, it is expected that the library generates the secret key using secure randomness. However, a recent change broke this guarantee and uses an insecure seed for key pair generation. Since the private key of this identity (535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe) is compromised, one could lose funds associated with the principal on ledgers or lose access to a canister where this principal is the controller.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Internet Computer · agent-jsfrom v0.20.0-beta.0 before v1.0.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Use of Hard-coded Cryptographic Key · Cryptography
Vendor: Internet Computer
Published: February 2024
Band: Unlikely (under 1%), February 2024

CoverageNo articles yet

No CyberSIXT article names CVE-2024-1631 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.