The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3455-1 advisory.

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - ## 2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS  This is a security release.  ### Notable     Changes  The following CVEs are fixed in this release:  * [CVE-2023-30581](https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2023-30581): `mainModule.__proto__` Bypass Experimental Policy Mechanism (High) *     [CVE-2023-30585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30585): Privilege escalation via     Malicious Registry Key manipulation during Node.js installer repair process (Medium) *     [CVE-2023-30588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30588): Process interuption due     to invalid Public Key information in x509 certificates (Medium) *     [CVE-2023-30589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30589): HTTP Request Smuggling     via Empty headers separated by CR (Medium) * [CVE-2023-30590](https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2023-30590): DiffieHellman does not generate keys after setting a private key     (Medium) * OpenSSL Security Releases   * [OpenSSL security advisory 28th     March](https://www.openssl.org/news/secadv/20230328.txt).   * [OpenSSL security advisory 20th     April](https://www.openssl.org/news/secadv/20230420.txt).   * [OpenSSL security advisory 30th     May](https://www.openssl.org/news/secadv/20230530.txt) * c-ares vulnerabilities:   *     [GHSA-9g78-jv2r-p7vc](https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc)   *     [GHSA-8r8p-23f3-64c2](https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2)   *     [GHSA-54xr-f67r-4pc4](https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4)   *     [GHSA-x6mf-cxr9-8q6v](https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v)  More     detailed information on each of the vulnerabilities can be found in [June 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/) blog post.
    (CVE-2023-30581, CVE-2023-30590)

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module. This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the     time this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32006)

  - A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15 / openSUSE 15 Security Update : nodejs12 (SUSE-SU-2023:3455-1)

critical Nessus Plugin ID 180305

Version 1.1

Version 1.0

Version 1.1 Aug 31, 2023, 4:09 AM Detection Plugin Feed: 202308310409
Version 1.0 Aug 30, 2023, 10:10 PM New Plugin Feed: 202308302210