Lucene search

K
osvGoogleOSV:ALSA-2023:4331
HistoryJul 31, 2023 - 12:00 a.m.

Moderate: nodejs security, bug fix, and enhancement update

2023-07-3100:00:00
Google
osv.dev
9
node.js
upgrade
security fixes
cve-2023-30581
cve-2023-30588
cve-2023-30589
cve-2023-30590
bz#2223334
bz#2223336
bz#2223338
bz#2223340
bz#2223342
bz#2223344

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.3%

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223334, BZ#2223336, BZ#2223338, BZ#2223340, BZ#2223342, BZ#2223344)

Security Fix(es):

  • nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
  • nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
  • nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
  • nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

40.3%