USN-6672-1: Node.js vulnerabilities
Morgan Jones discovered that Node.js incorrectly handled certain inputs that leads to false positive errors during some cryptographic operations. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 23.10. (CVE-2023-23919) It was discovered that Node.js incorrectly handled certain inputs leaded to a untrusted search path vulnerability. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a privilege escalation. (CVE-2023-23920) Matt Caswell discovered that Node.js incorrectly handled certain inputs with specially crafted ASN.1 object identifiers or data containing them. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-2650)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libnode108to a version that resolves this vulnerability.Fixed in 18.13.0+dfsg1-1ubuntu2.1 - Upgrade
Upgrade
ubuntu/nodejsto a version that resolves this vulnerability.Fixed in 18.13.0+dfsg1-1ubuntu2.1 - Upgrade
Upgrade
ubuntu/libnode72to a version that resolves this vulnerability.Fixed in 12.22.9~dfsg-1ubuntu3.4 - Upgrade
Upgrade
ubuntu/nodejsto a version that resolves this vulnerability.Fixed in 12.22.9~dfsg-1ubuntu3.4 - Upgrade
Upgrade
ubuntu/libnode64to a version that resolves this vulnerability.Fixed in 10.19.0~dfsg-3ubuntu1.5 - Upgrade
Upgrade
ubuntu/nodejsto a version that resolves this vulnerability.Fixed in 10.19.0~dfsg-3ubuntu1.5
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6672-1?
The severity of USN-6672-1 indicates a potential vulnerability in Node.js that could lead to remote exploitation through specially crafted input files.
How do I fix USN-6672-1?
To fix USN-6672-1, upgrade to the patched versions available for the affected Node.js packages as specified in the advisory.
What are the affected versions in USN-6672-1?
The affected versions include Node.js 10, 12, and 18, specifically those below the specified remedial versions in the advisory.
Who discovered the vulnerability USN-6672-1?
The vulnerability USN-6672-1 was discovered by Morgan Jones.
What type of vulnerability is identified in USN-6672-1?
USN-6672-1 identifies an input handling vulnerability in Node.js that results in false positive errors during cryptographic operations.