Critical NULL Pointer Dereference Vulnerability in OpenSSL and Node.js Packages
Summary
UBUNTU-CVE-2023-0401: A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. Affects nodejs versions < 12.22.9~dfsg-1ubuntu3.3. Fixed in 12.22.9~dfsg-1ubuntu3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used library that provides robust cryptographic functions and protocols, essential for secure communications over networks. Node.js, built on Chrome's V8 JavaScript engine, allows developers to build scalable network applications. Both packages are integral to many applications, but they are susceptible to vulnerabilities that can compromise their functionality and security.
Vulnerability Detail
A NULL pointer dereference vulnerability exists in OpenSSL when verifying signatures on PKCS7 signed or signedAndEnveloped data. This issue arises when the hash algorithm used for the signature is recognized by OpenSSL, but its implementation is unavailable, leading to a failure in digest initialization. The absence of a check for the return value from this initialization function can result in invalid usage of the digest API, potentially causing application crashes. This vulnerability can affect third-party applications that utilize these functions to verify signatures on untrusted data.
How To Fix
Minimum fixed version
12.22.9~dfsg-1ubuntu3.3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the legacy provider is loaded in your OpenSSL configuration to avoid the unavailability of the hash algorithm. This can be done by modifying the OpenSSL configuration file to include the legacy provider.
Conclusion
The NULL pointer dereference vulnerability in OpenSSL and Node.js poses significant risks to applications relying on these libraries. It is crucial to update to the patched versions to mitigate potential impacts. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions are OpenSSL 3.0.2-0ubuntu1.8 and Node.js 12.22.9~dfsg-1ubuntu3.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to application crashes and potential denial of service if third-party applications rely on the affected functions.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
