JavaScript SDK 0.5.3
Security
- CVE-2022-39218:
Fixed
Math.random
andcrypto.getRandomValues
methods to always use sufficiently random values. The previous versions would use a PRNG (pseudorandom number generator) which we would seed with a random value however due to our use of Wizer, the initial value to seed the PRNG was baked-in to the final WebAssembly module meaning the sequence of numbers generated was predictable for that specific WebAssembly module. The new implementations of bothMath.random
andcrypto.getRandomValues
do not use a PRNG and instead pull random values from WASI (WebAssembly System Interface) libc’srandom_get
function, which is always a sufficiently random value.
An attacker with access to the same WebAssembly module that calls the affected methods could use the fixed seed to predict random numbers generated by these functions. This information could be used to bypass cryptographic security controls, for example to disclose sensitive data encrypted by functions that use these generators.
Developers should update affected modules after applying this patch. Any secrets generated using affected versions should be rotated. Any sensitive ciphertext generated using affected versions should be considered unsafe, e.g. and be deleted or re-generated.
Fixed
Updated the Typescript definitions for the
console
methods to indicate that they now accept any number of objects. (#258)Store the Object-Store key string into a native object to avoid it becoming garbage collected before being used within
ObjectStore.prototype.get
orObjectStore.prototype.put
((381242)
Prior change: CLI v3.3.0
Following change: Add account_name support to GCP logging configurations