CVE-2023-32006
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Paquets affectés
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"16.20.2"},{"introduced":"17.0.0"},{"fixed":"18.17.1"},{"introduced":"19.0.0"},{"fixed":"20.5.1"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"16.20.2"},{"introduced":"17.0.0"},{"fixed":"18.17.1"},{"introduced":"19.0.0"},{"fixed":"20.5.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-32006 nodejs Corrigé dans: 16.20.2-r0
- Debian DEBIAN-CVE-2023-32006 nodejs
Références
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- web hackerone.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org