CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30586
https://notcve.org/view.php?id=CVE-2023-30586
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. • https://hackerone.com/reports/1954535 https://security.netapp.com/advisory/ntap-20230803-0008 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2023-30589 – nodejs: HTTP Request Smuggling via Empty headers separated by CR
https://notcve.org/view.php?id=CVE-2023-30589
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 A vulnerability has been identified in the Node.js, where llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). • https://hackerone.com/reports/2001873 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE https://lists.fedoraproject. •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-23918 – Node.js: Permissions policies can be bypassed via process.mainModule
https://notcve.org/view.php?id=CVE-2023-23918
A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. • https://nodejs.org/en/blog/vulnerability/february-2023-security-releases https://security.netapp.com/advisory/ntap-20230316-0008 https://access.redhat.com/security/cve/CVE-2023-23918 https://bugzilla.redhat.com/show_bug.cgi?id=2171935 • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2023-23919 – Node.js: OpenSSL error handling issues in nodejs crypto library
https://notcve.org/view.php?id=CVE-2023-23919
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service. • https://hackerone.com/reports/1808596 https://nodejs.org/en/blog/vulnerability/february-2023-security-releases https://security.netapp.com/advisory/ntap-20230316-0008 https://access.redhat.com/security/cve/CVE-2023-23919 https://bugzilla.redhat.com/show_bug.cgi?id=2172170 • CWE-310: Cryptographic Issues •
CVSS: 4.2EPSS: 0%CPEs: 8EXPL: 0CVE-2023-23920 – Node.js: insecure loading of ICU data through ICU_DATA environment variable
https://notcve.org/view.php?id=CVE-2023-23920
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. • https://lists.debian.org/debian-lts-announce/2023/02/msg00038.html https://nodejs.org/en/blog/vulnerability/february-2023-security-releases https://security.netapp.com/advisory/ntap-20230316-0008 https://www.debian.org/security/2023/dsa-5395 https://access.redhat.com/security/cve/CVE-2023-23920 https://bugzilla.redhat.com/show_bug.cgi?id=2172217 • CWE-426: Untrusted Search Path •