CVE-2023-38552
Summary
| CVE | CVE-2023-38552 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-10-18 04:15:00 UTC |
| Updated | 2023-11-16 16:15:00 UTC |
| Description | When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. |
Risk And Classification
Problem Types: CWE-345
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.netapp.com/advisory/ntap-20231116-0013 | security.netapp.com | ||
| [SECURITY] Fedora 38 Update: nodejs18-18.18.2-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 39 Update: nodejs18-18.18.2-1.fc39 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| HackerOne | MISC | hackerone.com | |
| [SECURITY] Fedora 37 Update: nodejs18-18.18.2-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: nodejs20-20.8.1-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 38 Update: nodejs20-20.8.1-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 39 Update: nodejs20-20.8.1-1.fc39 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 161007 Oracle Enterprise Linux Security Update for 18 (ELSA-2023-5849)
- 161010 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-5869)
- 161192 Oracle Enterprise Linux Security Update for nodejs:20 (ELSA-2023-7205)
- 242376 Red Hat Update for nodejs:18 (RHSA-2023:5849)
- 242385 Red Hat Update for nodejs:18 (RHSA-2023:5869)
- 242429 Red Hat Update for nodejs:20 (RHSA-2023:7205)
- 284660 Fedora Security Update for nodejs18 (FEDORA-2023-d5030c983c)
- 284672 Fedora Security Update for nodejs20 (FEDORA-2023-f66fc0f62a)
- 284673 Fedora Security Update for nodejs20 (FEDORA-2023-4d2fd884ea)
- 284674 Fedora Security Update for nodejs18 (FEDORA-2023-e9c04d81c1)
- 285187 Fedora Security Update for nodejs20 (FEDORA-2023-7b52921cae)
- 285188 Fedora Security Update for nodejs18 (FEDORA-2023-dbe64661af)
- 296106 Oracle Solaris 11.4 Support Repository Update (SRU) 64.157.2 Missing (CPUOCT2023)
- 356619 Amazon Linux Security Advisory for nodejs : ALAS2023-2023-412
- 378951 Node.js Multiple Security Vulnerabilties (October 13, 2023 Security Release)
- 503388 Alpine Linux Security Update for nodejs-current
- 503389 Alpine Linux Security Update for nodejs
- 505901 Alpine Linux Security Update for nodejs
- 506129 Alpine Linux Security Update for nodejs-current
- 6000404 Debian Security Update for nodejs (DSA 5589-1)
- 755122 SUSE Enterprise Linux Security Update for nodejs18 (SUSE-SU-2023:4133-1)
- 755131 SUSE Enterprise Linux Security Update for nodejs18 (SUSE-SU-2023:4155-1)
- 755167 SUSE Enterprise Linux Security Update for nodejs18 (SUSE-SU-2023:4207-1)
- 755230 SUSE Enterprise Linux Security Update for nodejs12 (SUSE-SU-2023:4374-1)
- 755231 SUSE Enterprise Linux Security Update for nodejs12 (SUSE-SU-2023:4373-1)
- 907585 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs18 (31614-1)
- 941306 AlmaLinux Security Update for nodejs:18 (ALSA-2023:5869)
- 941309 AlmaLinux Security Update for nodejs:18 (ALSA-2023:5849)
- 941479 AlmaLinux Security Update for nodejs:20 (ALSA-2023:7205)
- 961085 Rocky Linux Security Update for nodejs:20 (RLSA-2023:7205)