CVE-2023-38552

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return...

Original description

The description as published by the source.

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check.
Impacts:
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2023-38552 nodejs Fixed in: 18.18.2-r0
Debian DEBIAN-CVE-2023-38552 nodejs Fixed in: 18.19.0+dfsg-6~deb12u1

Original description

Affected packages

Fix status by distribution

References