The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5362 advisory.

  - Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the function new Range, when untrusted user data is provided as a range. (CVE-2022-25883)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

  - The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules     outside of the policy.json definition for a given module. This vulnerability affects all users using the     experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the     time this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32006)

  - A privilege escalation vulnerability exists in the experimental policy mechanism in all active release     lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy     mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`     run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time     this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS 8 : nodejs:18 (CESA-2023:5362)

critical Nessus Plugin ID 181894

Version 1.1

Version 1.0

Version 1.1 Feb 8, 2024, 7:35 PM Detection (updated detection logic) Plugin Feed: 202402081935
Version 1.0 Sep 26, 2023, 10:53 PM New Plugin Feed: 202309262253