Debian Nodejs vulnerabilities

CVE-2023-32558 [HIGH] CVE-2023-32558: nodejs - The use of the deprecated API `process.binding()` can bypass the permission mode... The use of the deprecated API `process.binding()` can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Scope: local bookworm: resolved bullseye: resolved forky: r

CVE-2023-32004 [HIGH] CVE-2023-32004: nodejs - A vulnerability has been discovered in Node.js version 20, specifically within t... A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the t

CVE-2023-39331 [HIGH] CVE-2023-39331: nodejs - A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently... A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an

CVE-2023-30589 [HIGH] CVE-2023-30589: llhttp - The llhttp parser in the http module in Node v20.2.0 does not strictly use the C... The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all N

CVE-2023-30584 [HIGH] CVE-2023-30584: nodejs - A vulnerability has been discovered in Node.js version 20, specifically within t... A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. Scope: local bookworm: resolved bullseye: resolv

CVE-2022-35255 [CRITICAL] CVE-2022-35255: nodejs - A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to ... A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntr

CVE-2022-32212 [HIGH] CVE-2022-32212: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20... A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks. Scope: local bookworm: resolved (fixed in 18.6.0+dfsg-3) bullseye: resolved (fi

CVE-2022-21824 [HIGH] CVE-2022-21824: nodejs - Due to the formatting logic of the "console.table()" function it was not safe to... Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be

CVE-2022-43548 [HIGH] CVE-2022-43548: nodejs - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18... A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this issue in https://cve.mitre.org/cgi-bin/cvename.cgi?na

CVE-2022-32213 [MEDIUM] CVE-2022-32213: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j... The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). Scope: local forky: resolved sid: resolved

CVE-2022-32215 [MEDIUM] CVE-2022-32215: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j... The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). Scope: local forky: resolved sid: resolved

CVE-2022-32214 [MEDIUM] CVE-2022-32214: llhttp - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.j... The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). Scope: local forky: resolved sid: resolved

CVE-2022-32222 [MEDIUM] CVE-2022-32222: nodejs - A cryptographic vulnerability exists on Node.js on linux in versions of 18.x pri... A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: res

CVE-2022-35256 [MEDIUM] CVE-2022-35256: llhttp - The llhttp parser in the http module in Node v18.7.0 does not correctly handle h... The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. Scope: local forky: resolved sid: resolved

CVE-2022-32223 [HIGH] CVE-2022-32223: nodejs - Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain cond... Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `

CVE-2021-22930 [CRITICAL] CVE-2021-22930: nodejs - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free at... Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Scope: local bookworm: resolved (fixed in 12.22.4~dfsg-1) bullseye: resolved (fixed in 12.22.5~dfsg-2~11u1) forky: resolved (fixed in 12.22.4~dfsg-1) sid: resolved (fixed in 12.22.4~dfsg

CVE-2021-22883 [HIGH] CVE-2021-22883: nodejs - Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial ... Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e

CVE-2021-44531 [HIGH] CVE-2021-44531: nodejs - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specif... Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not m

CVE-2021-22884 [HIGH] CVE-2021-22884: nodejs - Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebin... Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be

CVE-2021-22940 [HIGH] CVE-2021-22940: nodejs - Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free at... Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Scope: local bookworm: resolved (fixed in 12.22.5~dfsg-1) bullseye: resolved forky: resolved (fixed in 12.22.5~dfsg-1) sid: resolved (fixed in 12.22.5~dfsg-1) trixie: resolved (fixed in 12.2