CVE-2023-38552

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check.
Impacts:
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.
Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami node-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]

Bitnami node

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"18.18.2"},{"introduced":"19.0.0"},{"fixed":"20.8.1"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2023-38552 nodejs Corrigé dans: 18.18.2-r0
Debian DEBIAN-CVE-2023-38552 nodejs Corrigé dans: 18.19.0+dfsg-6~deb12u1

Description d'origine

Paquets affectés

État des correctifs par distribution

Références