CVE-2023-30590

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values".

The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

No affected versions have been published.

Timeline

Published: Nov 28, 2023
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-305917.5Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking `eventName.startsWith()` or `event CVE-2023-30605.4A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as problematic. This vulnerability affects CVE-2023-306017.8Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra CVE-2023-306027.5Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this v CVE-2023-306039.8Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to chang CVE-2023-306049.8It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An u CVE-2023-306056.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacke CVE-2023-306064.9Discourse is an open source platform for community discussion. In affected versions a user logged as an administrator can call arbitrary met CVE-2023-306078.8icingaweb2-module-jira provides integration with Atlassian Jira. Starting in version 1.3.0 and prior to version 1.3.2, template and field co CVE-2023-306087.5sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnera CVE-2023-306094.7matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages CVE-2023-30619.8A vulnerability was found in code-projects Agro-School Management System 1.0 and classified as critical. This issue affects some unknown pro