UBUNTU-CVE-2023-30588

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-30588
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-30588.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-30588
Related
Published
2023-11-28T20:15:00Z
Modified
2023-11-28T20:15:00Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.

References

Affected packages

Ubuntu:24.04:LTS / nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.19.1+dfsg-2ubuntu4

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode-dev"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-doc"
        }
    ]
}