CVE-2023-23919

NameCVE-2023-23919
DescriptionA cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1031834

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nodejs (PTS)buster10.24.0~dfsg-1~deb10u1fixed
buster (security)10.24.0~dfsg-1~deb10u3fixed
bullseye12.22.12~dfsg-1~deb11u3fixed
bullseye (security)12.22.12~dfsg-1~deb11u4fixed
sid, trixie, bookworm18.13.0+dfsg1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nodejssourcebuster(not affected)
nodejssourcebullseye(not affected)
nodejssource(unstable)(unfixed)1031834

Notes

[bookworm] - nodejs <postponed> (Can be fixed along with next update)
[bullseye] - nodejs <not-affected> (X509Certificate API introduced in v15.6.0)
[buster] - nodejs <not-affected> (X509Certificate API introduced in v15.6.0)
https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/#node-js-openssl-error-handling-issues-in-nodejs-crypto-library-medium-cve-2023-23919
https://hackerone.com/reports/1808596
https://github.com/nodejs/node/commit/438812e14d3b2a705fb639b69e37c6cc4e7c8029

Search for package or bug name: Reporting problems