{"source":1096365,"name":"crypto-js","dependency":"crypto-js","title":"crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","url":"https://github.com/advisories/GHSA-xwcq-pm8m-c4vf","severity":"critical","versions":["3.1.2-1","3.1.2-2","3.1.2-3","3.1.2-4","3.1.2-5","3.1.2-6","3.1.2","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9-1","3.2.0","3.2.1","3.3.0","4.0.0","4.1.0","4.1.1","4.2.0"],"vulnerableVersions":["3.1.2-1","3.1.2-2","3.1.2-3","3.1.2-4","3.1.2-5","3.1.2-6","3.1.2","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9-1","3.2.0","3.2.1","3.3.0","4.0.0","4.1.0","4.1.1"],"cwe":["CWE-327","CWE-328","CWE-916"],"cvss":{"score":9.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"range":"<4.2.0","id":"rwx+Sm3uumhMcvcqwJj77iXR2k924ILg9WmhOVrpnc5RgV+kWLAm5Don+37gdTY8xBpBcqp4j7ZGX/UBCqEMuA=="}