Summary
It was discovered that Node.js incorrectly handled the use of invalid public
keys while creating an x509 certificate. If a user or an automated system were
tricked into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause a denial of service. This issue only affected
Ubuntu 23.10. (CVE-2023-30588)
It was discovered that Node.js incorrectly handled the use of CRLF sequences to
delimit HTTP requests. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to obtain unauthorised access. This issue only affected
Ubuntu 23.10. (CVE-2023-30589)
It was discovered that Node.js incorrectly described the generateKeys()
function in the documentation. This inconsistency could possibly lead to
security issues in applications that use these APIs.
(CVE-2023-30590)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | nodejs | 10.19.0~dfsg-3ubuntu1.6 |
| Ubuntu · 22.04 LTS 22.04:LTS | nodejs | 12.22.9~dfsg-1ubuntu3.5 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | nodejs | 0.10.25~dfsg2-2ubuntu1.2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nodejs | 4.2.6~dfsg-1ubuntu4.2+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nodejs | 8.10.0~dfsg-2ubuntu0.4+esm5 |
Vulnerabilities 3
-
High 7.5
llhttp vulnerable to HTTP request smuggling
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parse…
-
Unscored —
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect te…
-
Unscored —
The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, t…