Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js security releases for June 20, 2023

Security updates address vulnerabilities in Node.js and bundled OpenSSL and c-ares components. Updated releases are Node.js v16.20.1, v18.16.1, and v20.3.1.

Announced

Node.js · Fixed in Node.js v16.20.1, Node.js v18.16.1, Node.js v20.3.1CVE-2023-30581CVE-2023-30584CVE-2023-30587CVE-2023-30582CVE-2023-30583CVE-2023-30585CVE-2023-30586CVE-2023-30588CVE-2023-30589CVE-2023-30590
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all supported Node.js release lines for the following issues.

Node.js

Node.js v16.20.1 (LTS)
Affected versions
16.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
18.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
20.x
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
Fixed versions
Node.js v16.20.1
Node.js v16.20.1 (LTS)
Node.js v18.16.1
Node.js v18.16.1 (LTS)
Node.js v20.3.1
Node.js v20.3.1 (Current)
Prerequisites
using the experimental policy mechanism
This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.
using the experimental permission model
This vulnerability affects all users using the experimental permission model in Node.js 20.
Related CVEs
CVE-2023-30581
mainModule.proto bypass experimental policy mechanism (High) (CVE-2023-30581)
CVE-2023-30584
Path traversal bypass in experimental permission model (High) (CVE-2023-30584)
CVE-2023-30587
Inspector protocol bypass the experimental permission model (High) (CVE-2023-30587)
CVE-2023-30582
fs.watchFile bypass in experimental permission model (Medium) (CVE-2023-30582)
CVE-2023-30583
fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583)
CVE-2023-30585
Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) (CVE-2023-30585)
CVE-2023-30586
OpenSSL engines can be used to bypass the permission model (Medium) (CVE-2023-30586)
CVE-2023-30588
Process interruption due to invalid Public Key information in x509 certificates (Medium) (CVE-2023-30588)
CVE-2023-30589
HTTP Request Smuggling via Empty headers separated by CR (Medium) (CVE-2023-30589)
CVE-2023-30590
DiffieHellman do not generate keys after setting a private key (Medium) (CVE-2023-30590)

Publisher severity

No explicit severity was extracted.

Event
#28023 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 20.3.1 (Current)

Node.js 20.3.1 fixes multiple security vulnerabilities, including issues in the experimental policy and permission mechanisms, installer repair, and HTTP request handling.

Announced

Node.js · Fixed in 20.3.1CVE-2023-30581CVE-2023-30584CVE-2023-30587CVE-2023-30582CVE-2023-30583CVE-2023-30585CVE-2023-30586CVE-2023-30588CVE-2023-30589CVE-2023-30590
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The following CVEs are fixed in this release:

Node.js

Node.js 20.3.1 (Current)
Affected versions
Not stated in this extraction
Fixed versions
20.3.1
Node.js 20.3.1 (Current)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2023-30581
CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30584
CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
CVE-2023-30587
CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
CVE-2023-30582
CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
CVE-2023-30583
CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
CVE-2023-30585
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30586
CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
CVE-2023-30588
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)

Publisher severity

No explicit severity was extracted.

Event
#27670 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement