CVE-2023-46809

EUVD-2023-50975
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 79%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodejsnodejs
18.0 ≤
𝑥
≤ 18.19.0
ADP
nodejsnodejs
20.0 ≤
𝑥
≤ 20.11.0
ADP
nodejsnodejs
21.0 ≤
𝑥
≤ 21.6.0
ADP
Debian logo
Debian Releases
Debian Product
Codename
nodejs
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
12.22.12~dfsg-1~deb11u5
fixed
sid
20.18.1+dfsg-1
fixed
trixie
20.18.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nodejs
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
mantic
ignored
noble
needs-triage
oracular
not-affected
trusty
ignored
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
nodejs12
suse enterprise server 15 SP2
12.22.12-150200.4.56.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.56.1
fixed
nodejs12-devel
suse enterprise server 15 SP2
12.22.12-150200.4.56.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.56.1
fixed
nodejs12-docs
suse enterprise server 15 SP2
12.22.12-150200.4.56.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.56.1
fixed
nodejs14
suse enterprise server 15 SP2
14.21.3-150200.15.55.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.55.1
fixed
nodejs14-devel
suse enterprise server 15 SP2
14.21.3-150200.15.55.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.55.1
fixed
nodejs14-docs
suse enterprise server 15 SP2
14.21.3-150200.15.55.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.55.1
fixed
nodejs16
suse enterprise server 15 SP3
16.20.2-150300.7.33.1
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.30.1
fixed
nodejs16-devel
suse enterprise server 15 SP3
16.20.2-150300.7.33.1
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.30.1
fixed
nodejs16-docs
suse enterprise server 15 SP3
16.20.2-150300.7.33.1
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.30.1
fixed
nodejs18
suse enterprise sap 15 SP5
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP4
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP5
18.19.1-150400.9.18.2
fixed
nodejs18-devel
suse enterprise sap 15 SP5
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP4
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP5
18.19.1-150400.9.18.2
fixed
nodejs18-docs
suse enterprise sap 15 SP5
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP4
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP5
18.19.1-150400.9.18.2
fixed
nodejs20
suse enterprise sap 15 SP5
20.11.1-150500.11.6.1
fixed
suse enterprise server 15 SP5
20.11.1-150500.11.6.1
fixed
nodejs20-devel
suse enterprise sap 15 SP5
20.11.1-150500.11.6.1
fixed
suse enterprise server 15 SP5
20.11.1-150500.11.6.1
fixed
nodejs20-docs
suse enterprise sap 15 SP5
20.11.1-150500.11.6.1
fixed
suse enterprise server 15 SP5
20.11.1-150500.11.6.1
fixed
npm12
suse enterprise server 15 SP2
12.22.12-150200.4.56.1
fixed
suse enterprise server 15 SP3
12.22.12-150200.4.56.1
fixed
npm14
suse enterprise server 15 SP2
14.21.3-150200.15.55.1
fixed
suse enterprise server 15 SP3
14.21.3-150200.15.55.1
fixed
npm16
suse enterprise server 15 SP3
16.20.2-150300.7.33.1
fixed
suse enterprise server 15 SP4
16.20.2-150400.3.30.1
fixed
npm18
suse enterprise sap 15 SP5
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP4
18.19.1-150400.9.18.2
fixed
suse enterprise server 15 SP5
18.19.1-150400.9.18.2
fixed
npm20
suse enterprise sap 15 SP5
20.11.1-150500.11.6.1
fixed
suse enterprise server 15 SP5
20.11.1-150500.11.6.1
fixed
Common Weakness Enumeration
References
https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html