CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)
A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling.
Other sources
Node.js could allow a remote attacker to obtain sensitive information, caused by a vulnerability in the privateDecrypt() API of the crypto library. An attacker could exploit this vulnerability to conduct a covert timing side-channel during PKCS#1 v1.5 padding error handling and obtain significant timing differences in decryption for valid and invalid ciphertexts.
— IBM
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/nodeto a version that resolves this vulnerability.Fixed in 18.19.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.19.1Fixed in 20.11.1Fixed in 21.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.19.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 20.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 21.6.2 - Upgrade
Upgrade
debian/nodejsto a version that resolves this vulnerability.Fixed in 18.20.4+dfsg-1~deb12u2Fixed in 18.20.4+dfsg-1~deb12u3Fixed in 20.19.2+dfsg-1+deb13u2Fixed in 20.19.2+dfsg-1+deb13u3Fixed in 24.21.0+dfsg+~cs24.13.4-1Fixed in 24.22.2+dfsg+~cs24.19.2-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-46809?
CVE-2023-46809 is considered a serious vulnerability that can lead to timing side-channel attacks during PKCS#1 v1.5 padding error handling.
How do I fix CVE-2023-46809?
To fix CVE-2023-46809, update the affected software to the latest patched versions provided by the vendor.
Which software does CVE-2023-46809 affect?
CVE-2023-46809 affects Node.js and different versions of IBM Cognos Analytics.
What type of attack can be performed using CVE-2023-46809?
CVE-2023-46809 allows attackers to exploit timing differences in decryption processes, potentially revealing sensitive data.
Is there a patch available for CVE-2023-46809?
Yes, patches are available for the affected versions of both Node.js and IBM Cognos Analytics.