Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23920: An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | nodejs | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-debuginfo | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-debugsource | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-devel | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-docs | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-full-i18n | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-libs | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | nodejs-libs-debuginfo | 1:18.12.1-1.amzn2023.0.4 |
| Amazon Linux · 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.4 |
| Amazon Linux · 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.4 |
Vulnerabilities 1
-
Medium 4.2
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-23920.html