CVE-2023-46233

crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.

• CWE-328
• CWE-916
• CWE-327

• https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40aPatch
• https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vfVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
• https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40aPatch
• https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vfVendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html

Published

Oct 25, 2023

Last Modified

Jun 23, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46228zchunk before 1.3.2 has multiple integer overflows via malfo…7.8
• CVE-2023-46229LangChain before 0.0.317 allows SSRF via document_loaders/re…8.8
• CVE-2023-4623A use-after-free vulnerability in the Linux kernel's net/sch…7.8
• CVE-2023-46230In Splunk Add-on Builder versions below 4.1.4, the app write…4.9
• CVE-2023-46231In Splunk Add-on Builder versions below 4.1.4, the applicati…7.2
• CVE-2023-46232era-compiler-vyper is the EraVM Vyper compiler for zkSync Er…5.3
• CVE-2023-46234browserify-sign is a package to duplicate the functionality …7.5
• CVE-2023-46235FOG is a free open-source cloning/imaging/rescue suite/inven…6.1
• CVE-2023-46236FOG is a free open-source cloning/imaging/rescue suite/inven…7.5
• CVE-2023-46237FOG is a free open-source cloning/imaging/rescue suite/inven…5.3
• CVE-2023-46238ZITADEL is an identity infrastructure management system. ZIT…5.4
• CVE-2023-46239quic-go is an implementation of the QUIC protocol in Go. Sta…7.5