CVE-2023-23919

Name
CVE-2023-23919
Description
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://hackerone.com/reports/1808596
MISC https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
CONFIRM https://security.netapp.com/advisory/ntap-20230316-0008/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 14.0.0 <= 14.14.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 16.0.0 <= 16.12.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 18.0.0 <= 18.11.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* nodejs >= 18.0.0 < 18.14.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* nodejs >= 16.0.0 < 16.19.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* nodejs >= 14.0.0 < 14.21.3
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* nodejs >= 19.0.0 < 19.2.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nodejs edge-main 18.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nodejs edge-main 18.14.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.13.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 18.12.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.18.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.18.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.17.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.17.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.16.0-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.16.0-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 16.13.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.18.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.17.6-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.17.5-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.17.4-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nodejs edge-main 14.16.1-r0 None possibly vulnerable
nodejs edge-main 14.16.0-r0 None possibly vulnerable
nodejs edge-main 14.15.5-r0 None possibly vulnerable
nodejs edge-main 14.15.4-r0 None possibly vulnerable
nodejs edge-main 14.15.1-r0 None possibly vulnerable
nodejs 3.22-main 18.14.1-r0 None fixed
nodejs 3.22-main 18.12.1-r0 None possibly vulnerable
nodejs 3.22-main 16.17.1-r0 None possibly vulnerable
nodejs 3.22-main 16.13.2-r0 None possibly vulnerable
nodejs 3.22-main 14.18.1-r0 None possibly vulnerable
nodejs 3.22-main 14.17.6-r0 None possibly vulnerable
nodejs 3.22-main 14.17.5-r0 None possibly vulnerable
nodejs 3.22-main 14.17.4-r0 None possibly vulnerable
nodejs 3.22-main 14.16.1-r0 None possibly vulnerable
nodejs 3.22-main 14.16.0-r0 None possibly vulnerable
nodejs 3.22-main 14.15.5-r0 None possibly vulnerable
nodejs 3.22-main 14.15.4-r0 None possibly vulnerable
nodejs 3.22-main 14.15.1-r0 None possibly vulnerable
nodejs 3.21-main 18.14.1-r0 None fixed
nodejs 3.21-main 18.12.1-r0 None possibly vulnerable
nodejs 3.21-main 16.17.1-r0 None possibly vulnerable
nodejs 3.21-main 16.13.2-r0 None possibly vulnerable
nodejs 3.21-main 14.18.1-r0 None possibly vulnerable
nodejs 3.21-main 14.17.6-r0 None possibly vulnerable
nodejs 3.21-main 14.17.5-r0 None possibly vulnerable
nodejs 3.21-main 14.17.4-r0 None possibly vulnerable
nodejs 3.21-main 14.16.1-r0 None possibly vulnerable
nodejs 3.21-main 14.16.0-r0 None possibly vulnerable
nodejs 3.21-main 14.15.5-r0 None possibly vulnerable
nodejs 3.21-main 14.15.4-r0 None possibly vulnerable
nodejs 3.21-main 14.15.1-r0 None possibly vulnerable
nodejs 3.20-main 18.14.1-r0 None fixed
nodejs 3.20-main 18.12.1-r0 None possibly vulnerable
nodejs 3.20-main 16.17.1-r0 None possibly vulnerable
nodejs 3.20-main 16.13.2-r0 None possibly vulnerable
nodejs 3.20-main 14.18.1-r0 None possibly vulnerable
nodejs 3.20-main 14.17.6-r0 None possibly vulnerable
nodejs 3.20-main 14.17.5-r0 None possibly vulnerable
nodejs 3.20-main 14.17.4-r0 None possibly vulnerable
nodejs 3.20-main 14.16.1-r0 None possibly vulnerable
nodejs 3.20-main 14.16.0-r0 None possibly vulnerable
nodejs 3.20-main 14.15.5-r0 None possibly vulnerable
nodejs 3.20-main 14.15.4-r0 None possibly vulnerable
nodejs 3.20-main 14.15.1-r0 None possibly vulnerable
nodejs 3.19-main 18.14.1-r0 None fixed
nodejs 3.19-main 18.12.1-r0 None possibly vulnerable
nodejs 3.19-main 16.17.1-r0 None possibly vulnerable
nodejs 3.19-main 16.13.2-r0 None possibly vulnerable
nodejs 3.19-main 14.18.1-r0 None possibly vulnerable
nodejs 3.19-main 14.17.6-r0 None possibly vulnerable
nodejs 3.19-main 14.17.5-r0 None possibly vulnerable
nodejs 3.19-main 14.17.4-r0 None possibly vulnerable
nodejs 3.19-main 14.16.1-r0 None possibly vulnerable
nodejs 3.19-main 14.16.0-r0 None possibly vulnerable
nodejs 3.19-main 14.15.5-r0 None possibly vulnerable
nodejs 3.19-main 14.15.4-r0 None possibly vulnerable
nodejs 3.19-main 14.15.1-r0 None possibly vulnerable
nodejs 3.18-main 18.14.1-r0 None fixed
nodejs 3.17-main 18.14.1-r0 Jakub Jirutka <jakub@jirutka.cz> fixed