CVE-2023-46809

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
hackeroneCNA
---
---
CISA-ADPADP
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 68%
VendorProductVersion
nodejsnodejs
18.19.0 ≤
𝑥
≤ 18.19.0
nodejsnodejs
20.11.0 ≤
𝑥
≤ 20.11.0
nodejsnodejs
21.6.0 ≤
𝑥
≤ 21.6.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nodejs
bullseye
vulnerable
bullseye (security)
12.22.12~dfsg-1~deb11u5
fixed
bookworm
vulnerable
bookworm (security)
vulnerable
trixie
20.18.1+dfsg-1
fixed
sid
20.18.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nodejs
oracular
not-affected
noble
needs-triage
mantic
ignored
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
ignored
Common Weakness Enumeration
References
https://nodejs.org/en/blog/vulnerability/february-2024-security-releases