Low Severity Vulnerability in OpenSSL Affecting Node.js and Other Packages
Summary
UBUNTU-CVE-2023-6129: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instruct... Affects nodejs versions 12.22.5~dfsg-5ubuntu1 – 12.22.9~dfsg-1ubuntu3.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used library that provides cryptographic functions and protocols for secure communication over networks. It is integral to many applications, including web servers and client software. The affected packages in this vulnerability include Node.js, libssl-dev, and OpenSSL itself, all of which are crucial for secure data transmission and integrity in applications. This vulnerability specifically impacts the POLY1305 MAC implementation on PowerPC CPU platforms, which could lead to application state corruption.
Vulnerability Detail
The vulnerability arises from a bug in the POLY1305 MAC implementation in OpenSSL, which may corrupt the internal state of applications running on PowerPC CPUs that support vector instructions. If an attacker can influence the use of the POLY1305 MAC algorithm, it could lead to various consequences, including incorrect application behavior or denial of service. The issue is particularly concerning for TLS server applications using OpenSSL, as it could potentially allow an attacker to gain control over the application process. However, it is considered low severity due to the lack of known concrete applications affected by this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to monitor the usage of the POLY1305 MAC algorithm in your applications and ensure that they are updated to the latest versions to mitigate potential risks.
Conclusion
In summary, the vulnerability in OpenSSL affecting Node.js and other packages poses a low severity risk primarily to applications running on PowerPC CPUs. Users are encouraged to update their packages to the latest versions to ensure security and mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
The affected packages include Node.js, libssl-dev, libssl3, and OpenSSL.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application at Vulert Scanner without any signup.
The consequences can range from incorrect results in application calculations to denial of service or even complete control of the application process by an attacker.
Yes, a patch is available. Users should update to the latest versions of the affected packages to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
