A cryptographic vulnerability exists in Node.js (CVE-2023-23919)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.2.0"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.2.0"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2023-23919 nodejs Corrigé dans: 16.19.1-r0
Debian DEBIAN-CVE-2023-23919 nodejs Corrigé dans: 18.19.0+dfsg-6~deb12u1

Références

advisory security.netapp.com
advisory nvd.nist.gov
advisory github.com
web hackerone.com
web nodejs.org