CVE-2023-23920

NameCVE-2023-23920
DescriptionAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3344-1, DSA-5395-1, DSA-5589-1
Debian Bugs1031834

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nodejs (PTS)buster10.24.0~dfsg-1~deb10u1vulnerable
buster (security)10.24.0~dfsg-1~deb10u3fixed
bullseye (security), bullseye12.22.12~dfsg-1~deb11u4fixed
bookworm18.13.0+dfsg1-1vulnerable
bookworm (security)18.19.0+dfsg-6~deb12u1fixed
trixie18.19.1+dfsg-3fixed
sid18.19.1+dfsg-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nodejssourcebuster10.24.0~dfsg-1~deb10u3DLA-3344-1
nodejssourcebullseye12.22.12~dfsg-1~deb11u4DSA-5395-1
nodejssourcebookworm18.19.0+dfsg-6~deb12u1DSA-5589-1
nodejssource(unstable)18.13.0+dfsg1-1.11031834

Notes

https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/#node-js-insecure-loading-of-icu-data-through-icu_data-environment-variable-low-cve-2023-23920
https://github.com/nodejs/node/commit/f369c0a739b9f0182ededa834a2a44e6fec322d1

Search for package or bug name: Reporting problems