Lucene search

K
osvGoogleOSV:ALSA-2023:4034
HistoryJul 12, 2023 - 12:00 a.m.

Important: nodejs:16 security update

2023-07-1200:00:00
Google
osv.dev
10
node.js
security update
c-ares vulnerabilities
cve-2023-32067
cve-2023-31130
cve-2023-31147
cve-2023-31124

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.8%

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

  • c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
  • c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
  • c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
  • c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

45.8%