CVE-2023-30588
Description
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
Risk Information
Base Score
5.3
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
Exploitation Probability
0.03
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in Node.js 16 (x64) (16.20.1) | Windows |
| Multiple vulnerabilities are fixed in Node.js 16 (16.20.1) | Windows |
| Multiple vulnerabilities are fixed in Node.js 18 (x64) (18.16.1) | Windows |
| Multiple vulnerabilities are fixed in Node.js 18 (18.16.1) | Windows |
| Multiple vulnerabilities are fixed in Node.js 20.3.1 | Windows |
| Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.1.7 | Windows |
| Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4 | Windows |
| Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.1 | Windows |
| Multiple Vulnerabilities are affected in IBM Business Automation Workflow 20.0.0.2 | Windows |
| Multiple Vulnerabilities are affected in IBM Business Automation Workflow 19.0.0.3 | Windows |
| Multiple Vulnerabilities are affected in IBM Business Automation Workflow 21.0.3.1 | Windows |
| Multiple Vulnerabilities are affected in IBM Business Automation Workflow 22.0.2 | Windows |
| SUSE-SU-2023:2663-1(Web and Scripting Module 15-SP4 ) nodejs16-16.20.1-150400.3.21.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2663-1(Web and Scripting Module 15-SP4 ) nodejs16-debuginfo-16.20.1-150400.3.21.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2663-1(Web and Scripting Module 15-SP4 ) nodejs16-debugsource-16.20.1-150400.3.21.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2663-1(Web and Scripting Module 15-SP4 ) nodejs16-devel-16.20.1-150400.3.21.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2663-1(Web and Scripting Module 15-SP4 ) npm16-16.20.1-150400.3.21.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2663-1(Web and Scripting Module 15-SP4 ) nodejs16-docs-16.20.1-150400.3.21.1.noarch.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP4 ) nodejs18-debuginfo-18.16.1-150400.9.9.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP4 ) nodejs18-debugsource-18.16.1-150400.9.9.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP5 ) nodejs18-18.16.1-150400.9.9.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP5 ) nodejs18-debuginfo-18.16.1-150400.9.9.1.x86_64_15_SP5.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP5 ) nodejs18-debugsource-18.16.1-150400.9.9.1.x86_64_15_SP5.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP5 ) nodejs18-devel-18.16.1-150400.9.9.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP5 ) npm18-18.16.1-150400.9.9.1.x86_64.rpm | Linux |
| SUSE-SU-2023:2669-1(Web and Scripting Module 15-SP5 ) nodejs18-docs-18.16.1-150400.9.9.1.noarch.rpm | Linux |
| nodejs:16 security, bug fix, and enhancement update (RLSA-2023:4537) nodejs-nodemon-2.0.20-3.module+el8.7.0+1178+d52dba78.noarch.rpm | Linux |
| nodejs:16 security, bug fix, and enhancement update (RLSA-2023:4537) nodejs-packaging-25-1.module+el8.7.0+1108+49363b0d.noarch.rpm | Linux |
| Nodejs update (ELSA-2023-4330) nodejs-18.16.1-1.module+el9.2.0+21133+486db26c.x86_64.rpm | Linux |
| Nodejs-devel update (ELSA-2023-4330) nodejs-devel-18.16.1-1.module+el9.2.0+21133+486db26c.x86_64.rpm | Linux |
| Nodejs-docs update (ELSA-2023-4330) nodejs-docs-18.16.1-1.module+el9.2.0+21133+486db26c.noarch.rpm | Linux |
| Nodejs-full-i18n update (ELSA-2023-4330) nodejs-full-i18n-18.16.1-1.module+el9.2.0+21133+486db26c.x86_64.rpm | Linux |
| Nodejs-nodemon update (ELSA-2023-4330) nodejs-nodemon-2.0.20-2.module+el9.2.0+21038+115df6a2.noarch.rpm | Linux |
| Nodejs-packaging update (ELSA-2023-4330) nodejs-packaging-2021.06-4.module+el9.1.0+20762+f52d7401.noarch.rpm | Linux |
| Nodejs-packaging-bundler update (ELSA-2023-4330) nodejs-packaging-bundler-2021.06-4.module+el9.1.0+20762+f52d7401.noarch.rpm | Linux |
| Npm update (ELSA-2023-4330) npm-9.5.1-1.18.16.1.1.module+el9.2.0+21133+486db26c.x86_64.rpm | Linux |
| Nodejs update (ELSA-2023-4331) nodejs-16.20.1-1.el9_2.x86_64.rpm | Linux |
| Nodejs-docs update (ELSA-2023-4331) nodejs-docs-16.20.1-1.el9_2.noarch.rpm | Linux |
| Nodejs-full-i18n update (ELSA-2023-4331) nodejs-full-i18n-16.20.1-1.el9_2.x86_64.rpm | Linux |
| Nodejs-libs update (ELSA-2023-4331) nodejs-libs-16.20.1-1.el9_2.i686.rpm | Linux |
| Nodejs-libs update (ELSA-2023-4331) nodejs-libs-16.20.1-1.el9_2.x86_64.rpm | Linux |
| Npm update (ELSA-2023-4331) npm-8.19.4-1.16.20.1.1.el9_2.x86_64.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-docs-18.16.1-1.module+el8.8.0+1413+a47876c7.noarch.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-nodemon-2.0.20-2.module+el8.7.0+1177+510ae886.noarch.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-packaging-2021.06-4.module+el8.7.0+1072+5b168780.noarch.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-packaging-bundler-2021.06-4.module+el8.7.0+1072+5b168780.noarch.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-18.16.1-1.module+el9.2.0.z+19424+78951f07.x86_64.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-debuginfo-18.16.1-1.module+el9.2.0.z+19424+78951f07.x86_64.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-debugsource-18.16.1-1.module+el9.2.0.z+19424+78951f07.x86_64.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-devel-18.16.1-1.module+el9.2.0.z+19424+78951f07.x86_64.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-docs-18.16.1-1.module+el9.2.0.z+19424+78951f07.noarch.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-full-i18n-18.16.1-1.module+el9.2.0.z+19424+78951f07.x86_64.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-nodemon-2.0.20-2.module+el9.2.0.z+18497+a402347c.noarch.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-packaging-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update nodejs-packaging-bundler-2021.06-4.module+el9.1.0+15718+e52ec601.noarch.rpm | Linux |
| (RHSA-2023:4330)Moderate: security, bug fix, and enhancement update npm-9.5.1-1.18.16.1.1.module+el9.2.0.z+19424+78951f07.x86_64.rpm | Linux |
| nodejs security update(DSA-5589-1) nodejs_18.19.0+dfsg-6~deb12u1_amd64.deb | Linux |
| nodejs security update(DSA-5589-1) nodejs_18.19.0+dfsg-6~deb12u1_i386.deb | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) npm-9.5.1-1.18.16.1.1.module+el8.8.0+1413+a47876c7.x86_64.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-devel-18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm | Linux |
| nodejs:18 security, bug fix, and enhancement update (RLSA-2023:4536) nodejs-full-i18n-18.16.1-1.module+el8.8.0+1413+a47876c7.x86_64.rpm | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) libnode-dev_10.19.0~dfsg-3ubuntu1.6_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) libnode-dev_12.22.9~dfsg-1ubuntu3.5_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) libnode-dev_18.13.0+dfsg1-1ubuntu2.2_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) libnode108_18.13.0+dfsg1-1ubuntu2.2_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) libnode64_10.19.0~dfsg-3ubuntu1.6_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) libnode72_12.22.9~dfsg-1ubuntu3.5_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) nodejs_10.19.0~dfsg-3ubuntu1.6_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) nodejs_12.22.9~dfsg-1ubuntu3.5_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) nodejs_18.13.0+dfsg1-1ubuntu2.2_amd64.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) nodejs-doc_10.19.0~dfsg-3ubuntu1.6_all.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) nodejs-doc_12.22.9~dfsg-1ubuntu3.5_all.deb | Linux |
| An open-source, cross-platform JavaScript runtime environment. (USN-6735-1) nodejs-doc_18.13.0+dfsg1-1ubuntu2.2_all.deb | Linux |
| Npm update (ELSA-2025-8514) npm-10.8.2-1.20.19.2.1.module+el8.10.0+90611+29f3ae1e.x86_64.rpm | Linux |
| Nodejs-packaging-bundler update (ELSA-2025-8514) nodejs-packaging-bundler-2021.06-4.module+el8.10.0+90611+29f3ae1e.noarch.rpm | Linux |
| Nodejs-packaging update (ELSA-2025-8514) nodejs-packaging-2021.06-4.module+el8.10.0+90611+29f3ae1e.noarch.rpm | Linux |
| Nodejs-nodemon update (ELSA-2025-8514) nodejs-nodemon-3.0.1-1.module+el8.10.0+90611+29f3ae1e.noarch.rpm | Linux |
| Nodejs-full-i18n update (ELSA-2025-8514) nodejs-full-i18n-20.19.2-1.module+el8.10.0+90611+29f3ae1e.x86_64.rpm | Linux |
| Nodejs-docs update (ELSA-2025-8514) nodejs-docs-20.19.2-1.module+el8.10.0+90611+29f3ae1e.noarch.rpm | Linux |
| Nodejs-devel update (ELSA-2025-8514) nodejs-devel-20.19.2-1.module+el8.10.0+90611+29f3ae1e.x86_64.rpm | Linux |
| Nodejs update (ELSA-2025-8514) nodejs-20.19.2-1.module+el8.10.0+90611+29f3ae1e.x86_64.rpm | Linux |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-331257 | Node.js 16 (x64) (16.20.1) |
| PATCH-331256 | Node.js 16 (16.20.1) |
| PATCH-331763 | Node.js 18 (x64) (18.17.0) |
| PATCH-331762 | Node.js 18 (18.17.0) |
| PATCH-319042 | Node.js 10 (10.24.1) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234