Lucene search

K
mageiaGentoo FoundationMGASA-2023-0078
HistoryMar 02, 2023 - 12:14 a.m.

Updated nodejs packages fix security vulnerability

2023-03-0200:14:31
Gentoo Foundation
advisories.mageia.org
35
node.js
security vulnerability
bypassed permissions
insecure loading
icu data
openssl updates
npm update
cves
node.js 14

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

53.6%

The following CVEs are fixed in this release: CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High) CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post. This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory. This security release also includes an npm update for Node.js 14 to address a number of CVEs which either do not affect Node.js or are low severity in the context of Node.js. You can get more details for the individual CVEs in nodejs-dependency-vuln-assessments.

OSVersionArchitecturePackageVersionFilename
Mageia8noarchnodejs< 14.21.3-2.1nodejs-14.21.3-2.1.mga8

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

53.6%