CVE-2023-46233 in crypto-js as part of @react-pdf/[email protected]

[JesseObrien]

The Bug
CVE-2023-46233 describes the PBKDF2 algorithm implemented in crypto-js prior to version 4.2.0 as being 1,000 times weaker according to the spec from 1993 and 1,300,000 weaker than the current industry standard.

To Reproduce
Steps to reproduce the behavior including code snippet (if applies):

1. Install trivy via the installation docs
2. Clone this repo into a folder on your local machine.
3. Run trivy fs . inside that folder.
4. See that crypto-js is installed at version 4.0.0 and is listed as a critical severity CVE.

Expected behavior
Expect crypto-js dependency to be upgraded within the pdfkit package to the latest version, 4.2.0.

Desktop (please complete the following information):

• OS: OSX
• Browser: N/A
• React-pdf version: latest (3.0.2)

[strazto]

TL;DR for concerned react-pdf users

If the only crypto-js dependency in your project's manifest is via react-pdf, you're safe enough to dismiss the dependabot alert as Vulnerable code is not actually used

A few comments regarding this:

1. It causes dependabot (or whatever SCA tooling one might use) to raise a critical error for users of react-pdf, due to the crypto-js dependency
2. Since it's such an easy fix, the maintainers of react-pdf should certainly update their version of crypto-js to the mitigated version, for everyones' sanity
3. Important - Users of react-pdf can dismiss the dependabot warning
   • Per fix: import only md5 hash from crypto-js #1607 :
     • react-pdf only actually uses the md5 algorithm from crypto-js,
     • (I haven't thoroughly reviewed the rest of the codebase, but I assume md5 is used as a convenient hashing algorithm in a non security-critical context, and there's no reason to actually use PBKDF2 or any other crypto function )
     • so it's safe enough to assume the vulnerable algorithm is never actually used by react-pdf,
     • therefore, assuming the only dependency is via react-pdf's dependency, a project with react-pdf in its dependencies is not affected by this CVE,
     • The developer can dismiss the alert as Vulnerable code is not actually used