CVE-2023-30588
First published: Wed Jul 05 2023(Updated: )
Node.js is vulnerable to a denial of service, caused by invalid public key information in x509 certificates. By accessing public key info of provided certificates from user code, an attacker could exploit this vulnerability to force interruptions of application processing and cause a denial of service.
Credit: support@hackerone.com support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nodejs Node.js | >=16.0.0<16.20.1 | |
| Nodejs Node.js | >=18.0.0<18.16.1 | |
| Nodejs Node.js | >=20.0.0<20.3.1 | |
| IBM Cognos Analytics | <=12.0.0-12.0.1 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP2 | |
| IBM Cognos Analytics | <=11.1.1-11.1.7 FP7 | |
| ubuntu/nodejs | <18.13.0+dfsg1-1ubuntu2.2 | 18.13.0+dfsg1-1ubuntu2.2 |
| debian/nodejs | <=18.13.0+dfsg1-1 | 10.24.0~dfsg-1~deb10u1 10.24.0~dfsg-1~deb10u4 12.22.12~dfsg-1~deb11u4 18.19.0+dfsg-6~deb12u1 18.20.1+dfsg-4 20.13.1+dfsg-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2220777
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2220775
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2220774
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2220776
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2220773
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2220772
- https://access.redhat.com/errata/RHSA-2023:4331
- https://access.redhat.com/errata/RHSA-2023:4330
- https://access.redhat.com/errata/RHSA-2023:4536
- https://access.redhat.com/errata/RHSA-2023:4537
- https://access.redhat.com/security/cve/cve-2023-30588
- https://access.redhat.com/errata/RHSA-2023:5361
- https://access.redhat.com/errata/RHSA-2023:5533
- https://bugzilla.redhat.com/show_bug.cgi?id=2219838
- https://exchange.xforce.ibmcloud.com/vulnerabilities/258623
- https://www.ibm.com/support/pages/node/7123154 (Advisory)
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#process-interuption-due-to-invalid-public-key-information-in-x509-certificates-medium-cve-2023-30588
- https://www.cve.org/CVERecord?id=CVE-2023-30588
- https://ubuntu.com/security/notices/USN-6735-1
- https://nvd.nist.gov/vuln/detail/CVE-2023-30588
- https://launchpad.net/bugs/cve/CVE-2023-30588
- https://security-tracker.debian.org/tracker/CVE-2023-30588
- https://ubuntu.com/security/CVE-2023-30588
- https://hackerone.com/reports/1884159
- https://github.com/nodejs/node/commit/5a92ea7a3b6210f04c902e177f9dc673ae866393
Frequently Asked Questions
What is the vulnerability ID for this Node.js vulnerability?
The vulnerability ID for this Node.js vulnerability is CVE-2023-30588.
What is the title of this vulnerability?
The title of this vulnerability is 'Node.js is vulnerable to a denial of service caused by invalid public key information in x509 certificates.'
What is the severity of CVE-2023-30588?
The severity of CVE-2023-30588 is medium with a severity score of 5.3.
How does this vulnerability impact Node.js?
This vulnerability could be exploited by accessing public key info of provided certificates to force interruptions of application processing and cause a denial of service.
How can I fix this vulnerability?
To fix this vulnerability, update your Node.js installation to the latest version available.
- collector/mitre-cve
- collector/nvd-api
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-30588
- agent/severity
- agent/author
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- source/NVD
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/16.0.0
- version/nodejs node.js/18.0.0
- version/nodejs node.js/20.0.0
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.1
- version/ibm cognos analytics/11.2.0-11.2.4 fp2
- version/ibm cognos analytics/11.1.1-11.1.7 fp7
- package-manager/ubuntu
- package-manager/debian