Critical Node.js Vulnerabilities in Ubuntu Packages: Denial of Service and Unauthorized Access Risks
Summary
USN-6735-1: nodejs vulnerabilities. Affects nodejs versions < 0.10.25~dfsg2-2ubuntu1.2+esm2. Fixed in 0.10.25~dfsg2-2ubuntu1.2+esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications and has a rich ecosystem of libraries and frameworks. However, recent vulnerabilities have been discovered in various versions of Node.js packaged for Ubuntu, which could potentially expose applications to security risks.
Vulnerability Detail
The vulnerabilities stem from improper handling of public keys in x509 certificate creation and CRLF sequences in HTTP requests. Specifically, CVE-2023-30588 allows for denial of service attacks if a malicious file is opened, while CVE-2023-30589 could lead to unauthorized access through crafted HTTP requests. Additionally, CVE-2023-30590 highlights inconsistencies in the documentation of the generateKeys() function, which may lead to security issues in applications utilizing these APIs.
How To Fix
Minimum fixed version
0.10.25~dfsg2-2ubuntu1.2+esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize any files being processed by your Node.js applications. This can help mitigate the risk of denial of service and unauthorized access. Additionally, avoid opening untrusted files or data sources.
Conclusion
In summary, critical vulnerabilities have been identified in Node.js packages for various Ubuntu distributions, posing risks of denial of service and unauthorized access. It is crucial to update to the patched versions to safeguard your applications. Additionally, consider using Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for nodejs →
FAQ
The main vulnerabilities include improper handling of public keys leading to denial of service and CRLF sequence issues that could allow unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Affected versions include various Node.js packages across Ubuntu 14.04, 16.04, 18.04, 20.04, and 22.04 LTS.
Implement input validation and avoid processing untrusted files as a temporary workaround until you can apply the necessary updates.
More details can be found in the Ubuntu Security Notices, specifically USN-6735-1, which outlines the vulnerabilities and their implications.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
