CVE-2023-32006
published 2023-08-15CVE-2023-32006: The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module…
PriorityP350high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.27%
66.7th percentile
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 18.19.0+dfsg-6~deb12u1 (bookworm) | nodejs 18.19.0+dfsg-6~deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_nodejs18_18.17.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_nodejs_16.20.2-2_on_cbl_mariner_2.0 | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.20.2 | 16.20.2 |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.17.1 | 18.17.1 |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | >= 20.0 < 20.5.1 | 20.5.1 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | 16.0.0 – 16.20.1 | — |
| nodejs | node.js | 18.0.0 – 18.17.0 | — |
| nodejs | node.js | 20.0.0 – 20.5.0 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian8.8HIGH
vendor_msrc8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nodejs vulnerabilities
osv·2024-06-10·CVSS 9.8
CVE-2023-32002 [CRITICAL] nodejs vulnerabilities
nodejs vulnerabilities
It was discovered that Node.js incorrectly handled certain inputs when it is
using the policy mechanism. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to bypass the policy mechanism. (CVE-2023-32002, CVE-2023-32006)
It was discovered that Node.js incorrectly handled certain inputs when it is
using the policy mechanism. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to perform a privilege escalation. (CVE-2023-32559)
GHSA
GHSA-356r-x8g9-vh8c: The use of `module
ghsa_unreviewed·2023-08-15
CVE-2023-32006 [HIGH] CWE-693 GHSA-356r-x8g9-vh8c: The use of `module
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
OSV
CVE-2023-32006: The use of `module
osv·2023-08-15·CVSS 8.8
CVE-2023-32006 [HIGH] CVE-2023-32006: The use of `module
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
OSV
CVE-2023-32006: The use of `module
osv·2023-08-15·CVSS 8.8
CVE-2023-32006 [HIGH] CVE-2023-32006: The use of `module
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
CISA ICS
Siemens SINEC INS
cisa_ics·2024-11-14
Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Release DateNovember 14, 2024
Alert CodeICSA-24-319-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.9
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Authentication, Out-of-bounds Write, Ineffici
Ubuntu
Node.js vulnerabilities
vendor_ubuntu·2024-06-10·CVSS 9.8
CVE-2023-32002 [CRITICAL] Node.js vulnerabilities
Title: Node.js vulnerabilities
Summary: Several security issues were fixed in Node.js.
It was discovered that Node.js incorrectly handled certain inputs when it is
using the policy mechanism. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to bypass the policy mechanism. (CVE-2023-32002, CVE-2023-32006)
It was discovered that Node.js incorrectly handled certain inputs when it is
using the policy mechanism. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to perform a privilege escalation. (CVE-2023-32559)
Instructions: In general, a standard system update will make all the necessary changes.
CISA ICS
Siemens SINEC NMS
cisa_ics·2024-02-15
Siemens SINEC NMS
ICS Advisory
##
Siemens SINEC NMS
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-15
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC NMS
- Vulnerabilities: Out-of-bounds Read, Inadequate Encryption Strength, Double Free, Use After Free, NULL Pointer Dereference, Improper Input Validation, Missing Encryption of Sensitive Data, Allocation of Resources Wit
Red Hat
nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
vendor_redhat·2023-08-09·CVSS 8.8
CVE-2023-32006 [HIGH] CWE-213 nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x.
Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
A vulnerability was found in NodeJS. This security issue occurs as the use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
Mitigation: Mitigation for this issue is either not available or the currently avail
Microsoft
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users usin
vendor_msrc·2023-08-08·CVSS 8.8
CVE-2023-32006 [HIGH] The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users usin
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x 18.x and 20.x.
Please note that at the time this CVE was issued the policy is an experimental feature of Node.js.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transpar
Debian
CVE-2023-32006: nodejs - The use of `module.constructor.createRequire()` can bypass the policy mechanism ...
vendor_debian·2023·CVSS 8.8
CVE-2023-32006 [HIGH] CVE-2023-32006: nodejs - The use of `module.constructor.createRequire()` can bypass the policy mechanism ...
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Scope: local
bookworm: resolved (fixed in 18.19.0+dfsg-6~deb12u1)
bullseye: open
forky: resolved (fixed in 18.13.0+dfsg1-1.1)
sid: resolved (fixed in 18.13.0+dfsg1-1.1)
trixie: resolved (fixed in 18.13.0+dfsg1-1.1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://hackerone.com/reports/2043807https://lists.fedoraproject.org/archives/list/[email protected]/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/https://lists.fedoraproject.org/archives/list/[email protected]/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/https://security.netapp.com/advisory/ntap-20230915-0009/https://hackerone.com/reports/2043807https://lists.fedoraproject.org/archives/list/[email protected]/message/JQPELKG2LVTADSB7ME73AV4DXQK47PWK/https://lists.fedoraproject.org/archives/list/[email protected]/message/PBOZE2QZIBLFFTYWYN23FGKN6HULZ6HX/https://security.netapp.com/advisory/ntap-20230915-0009/
2023-08-15
Published