CVE-2023-46809

EUVD-2023-50975
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodejsnodejs
18.0 ≤
𝑥
≤ 18.19.0
ADP
nodejsnodejs
20.0 ≤
𝑥
≤ 20.11.0
ADP
nodejsnodejs
21.0 ≤
𝑥
≤ 21.6.0
ADP
Debian logo
Debian Releases
Debian Product
Codename
nodejs
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
12.22.12~dfsg-1~deb11u5
fixed
sid
20.18.1+dfsg-1
fixed
trixie
20.18.1+dfsg-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nodejs
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
mantic
ignored
noble
needs-triage
oracular
not-affected
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
https://nodejs.org/en/blog/vulnerability/february-2024-security-releases
https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html