Critical Vulnerability in Node.js: Inadequate Key Generation in Diffie-Hellman API
Summary
UBUNTU-CVE-2023-30590: The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to... Affects nodejs versions < 0.10.25~dfsg2-2ubuntu1.2+esm2. Fixed in 0.10.25~dfsg2-2ubuntu1.2+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected versions of Node.js are vulnerable due to a flaw in the generateKeys() API function, which fails to generate necessary keys correctly, potentially compromising application-level security.
Vulnerability Detail
The vulnerability arises from the generateKeys() API function returned from crypto.createDiffieHellman(). This function only generates missing or outdated keys, meaning it does not generate a private key if one has already been set. This behavior contradicts the documentation, which states that the function generates both private and public Diffie-Hellman key values. As a result, applications relying on this API for security may be exposed to significant risks, including unauthorized access and data breaches.
How To Fix
Minimum fixed version
0.10.25~dfsg2-2ubuntu1.2+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually ensure that both private and public keys are generated correctly by explicitly calling the necessary key generation functions in their application code. However, this is not a substitute for applying the patch.
Conclusion
The vulnerability in Node.js related to the generateKeys() API function poses significant security risks for applications relying on Diffie-Hellman key generation. It is crucial for developers to update to the patched versions to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for nodejs →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Affected versions include Node.js 0.10.25, 4.2.6, 8.10.0, 10.19.0, and 12.22.9 on various Ubuntu LTS distributions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground without any signup.
The potential risks include unauthorized access to sensitive data and compromised application-level security, which could lead to data breaches.
Some patched versions are available with Ubuntu Pro, while others do not require a subscription.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
