Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdxZ3gtNHE0Ny1qMnc1

Insecure Cryptography Algorithm in parsel

All versions of parsel use an insecure cryptography algorithm. The package uses aes-256-cbc without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.

Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.

Permalink: https://github.com/advisories/GHSA-wqgx-4q47-j2w5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdxZ3gtNHE0Ny1qMnc1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

Identifiers: GHSA-wqgx-4q47-j2w5
References:

• https://www.npmjs.com/advisories/1461
• https://github.com/advisories/GHSA-wqgx-4q47-j2w5

Blast Radius: 0.0

Affected Packages