An untrusted search path vulnerability exists in Node.js. (CVE-2023-23920)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.21.3"},{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2023-23920 nodejs Corrigé dans: 14.21.3-r0
Debian DEBIAN-CVE-2023-23920 nodejs Corrigé dans: 12.22.12~dfsg-1~deb11u4

Références

advisory security.netapp.com
advisory debian.org
advisory nvd.nist.gov
advisory github.com
web lists.debian.org
web nodejs.org