UBUNTU-CVE-2023-30581

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-30581
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-30581.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-30581
Related
Published
2023-11-23T00:15:00Z
Modified
2023-11-23T00:15:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js

References

Affected packages

Ubuntu:24.04:LTS / nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.19.1+dfsg-2ubuntu4

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode-dev"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-doc"
        }
    ]
}