A privilege escalation vulnerability exists in Node.js (CVE-2023-23918)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2023-23918 nodejs Corrigé dans: 14.21.3-r0
Debian DEBIAN-CVE-2023-23918 nodejs Corrigé dans: 18.19.0+dfsg-6~deb12u1

Références

advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web nodejs.org