Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b814656b by Salvatore Bonaccorso at 2023-11-22T20:52:52+01:00
Track fixed version for nodejs issues fixed with unstable upload
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5083,7 +5083,7 @@ CVE-2023-5625 (A regression was introduced in the Red Hat
build of python-eventl
- python-eventlet <not-affected> (Red Hat-specific regression)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2244717
CVE-2023-39333
- - nodejs <unfixed> (bug #1054892)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1054892)
[bullseye] - nodejs <not-affected> (Only affects 18.x and later)
[buster] - nodejs <not-affected> (Only affects 18.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/october-2023-security-releases#code-injection-via-webassembly-export-names-low---cve-2023-39333
@@ -5896,7 +5896,7 @@ CVE-2023-39277 (SonicOS post-authentication stack-based
buffer overflow vulnerab
CVE-2023-39276 (SonicOS post-authentication stack-based buffer overflow
vulnerability ...)
NOT-FOR-US: SonicOS
CVE-2023-38552 (When the Node.js policy feature checks the integrity of a
resource aga ...)
- - nodejs <unfixed> (bug #1054892)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1054892)
[bullseye] - nodejs <not-affected> (Only affects 18.x and later)
[buster] - nodejs <not-affected> (Only affects 18.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/october-2023-security-releases#integrity-checks-according-to-policies-can-be-circumvented-medium---cve-2023-38552
@@ -16127,7 +16127,7 @@ CVE-2023-33242 (Crypto wallets implementing the
Lindell17 TSS protocol might all
CVE-2023-33241 (Crypto wallets implementing the GG18 or GG20 TSS protocol
might allow ...)
NOT-FOR-US: Crypto wallets implementing the GG18 or GG20 TSS protocol
CVE-2023-32559 (A privilege escalation vulnerability exists in the
experimental policy ...)
- - nodejs <unfixed> (bug #1050739)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1050739)
[buster] - nodejs <not-affected> (v10.x doesn't support policy
manifests)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559
NOTE:
https://github.com/nodejs/node/commit/d4570fae358693b8f7fec05294b9bb92a966226d
(v18.x)
@@ -16136,7 +16136,7 @@ CVE-2023-32558 (The use of the deprecated API
`process.binding()` can bypass the
- nodejs <not-affected> (Only affects 20.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#processbinding-can-bypass-the-permission-model-through-path-traversal-highcve-2023-32558
CVE-2023-32006 (The use of `module.constructor.createRequire()` can bypass the
policy ...)
- - nodejs <unfixed> (bug #1050739)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1050739)
[buster] - nodejs <not-affected> (v10.x doesn't support policy
manifests)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006
NOTE:
https://github.com/nodejs/node/commit/15bced0bde93f24115b779a309d517845c87e17a
(v18.x)
@@ -16151,7 +16151,7 @@ CVE-2023-32003 (`fs.mkdtemp()` and `fs.mkdtempSync()`
can be used to bypass the
- nodejs <not-affected> (Only affects 20.x and later)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#fsmkdtemp-and-fsmkdtempsync-are-missing-getvalidatedpath-checks-lowcve-2023-32003
CVE-2023-32002 (The use of `Module._load()` can bypass the policy mechanism
and requir ...)
- - nodejs <unfixed> (bug #1050739)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1050739)
[buster] - nodejs <not-affected> (v10.x doesn't support policy
manifests)
NOTE:
https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002
NOTE:
https://github.com/nodejs/node/commit/15bced0bde93f24115b779a309d517845c87e17a
(v18.x)
@@ -29777,12 +29777,12 @@ CVE-2023-30591 (Denial-of-service in NodeBB <=
v2.8.10 allows unauthenticated at
NOT-FOR-US: NodeBB
CVE-2023-30590
RESERVED
- - nodejs <unfixed> (bug #1039990)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1039990)
[buster] - nodejs <postponed> (minor issue - Inconsistency Between
Implementation and Documented Design)
NOTE:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#diffiehellman-do-not-generate-keys-after-setting-a-private-key-medium-cve-2023-30590
NOTE: Fixed by:
https://github.com/nodejs/node/commit/1a5c9284ebce5cd71cf7a3c29759a748c373ac85
(v16.x)
CVE-2023-30589 (The llhttp parser in the http module in Node v20.2.0 does not
strictly ...)
- - nodejs <unfixed> (bug #1039990)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1039990)
[buster] - nodejs <not-affected> (llhttp dependency/embedding
introduced in 12.x)
- llhttp <itp> (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#http-request-smuggling-via-empty-headers-separated-by-cr-medium-cve-2023-30589
@@ -29791,7 +29791,7 @@ CVE-2023-30589 (The llhttp parser in the http module in
Node v20.2.0 does not st
NOTE: Fixed by:
https://github.com/nodejs/node/commit/e42ff4b0180f4e0f5712364dd6ea015559640152
(v16.x)
CVE-2023-30588
RESERVED
- - nodejs <unfixed> (bug #1039990)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1039990)
[buster] - nodejs <not-affected> (X509Certificate API introduced later)
NOTE:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#process-interuption-due-to-invalid-public-key-information-in-x509-certificates-medium-cve-2023-30588
NOTE: https://hackerone.com/reports/1884159
@@ -29821,7 +29821,7 @@ CVE-2023-30582
NOTE:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#fswatchfile-bypass-in-experimental-permission-model-medium-cve-2023-30582
CVE-2023-30581
RESERVED
- - nodejs <unfixed> (bug #1039990)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1039990)
[buster] - nodejs <not-affected> (v10.x doesn't support policy
manifests)
NOTE:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#mainmoduleproto-bypass-experimental-policy-mechanism-high-cve-2023-30581
NOTE: https://hackerone.com/reports/1877919
@@ -50226,12 +50226,12 @@ CVE-2023-0407
RESERVED
CVE-2023-23920 (An untrusted search path vulnerability exists in Node.js.
<19.6.1, <18 ...)
{DSA-5395-1 DLA-3344-1}
- - nodejs <unfixed> (bug #1031834)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1031834)
[bookworm] - nodejs <postponed> (Can be fixed along with next update)
NOTE:
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/#node-js-insecure-loading-of-icu-data-through-icu_data-environment-variable-low-cve-2023-23920
NOTE:
https://github.com/nodejs/node/commit/f369c0a739b9f0182ededa834a2a44e6fec322d1
CVE-2023-23919 (A cryptographic vulnerability exists in Node.js <19.2.0,
<18.14.1, <16 ...)
- - nodejs <unfixed> (bug #1031834)
+ - nodejs 18.13.0+dfsg1-1.1 (bug #1031834)
[bookworm] - nodejs <postponed> (Can be fixed along with next update)
[bullseye] - nodejs <not-affected> (X509Certificate API introduced in
v15.6.0)
[buster] - nodejs <not-affected> (X509Certificate API introduced in
v15.6.0)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b814656bd38386be853df7d8a62dc841c64b1e50
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b814656bd38386be853df7d8a62dc841c64b1e50
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
