crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard

CVE-2023-46233

What is CVE-2023-46233?

The crypto-js library, specifically its implementation of PBKDF2, has a severe vulnerability that compromises password security. Prior to version 4.2.0, the library’s PBKDF2 defaults to a SHA1 hash, which is outdated and considered insecure. Additionally, it employs a single iteration count of 1,000—falling short of modern security standards which advocate for significantly higher iteration counts. This makes both password protection and signature generation highly susceptible to attacks. Users are encouraged to update to version 4.2.0 or configure the library to utilize SHA256 with at least 250,000 iterations to bolster security against potential threats.

References