CVE-2023-46809

CVSS 7.4 HIGHEPSS 1.3%CWE-385

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Produtos afetados

NodeJS · Node

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html https://nodejs.org/en/blog/vulnerability/february-2024-security-releases