Debian dla-3776 : libnode-dev - security update

high Nessus Plugin ID 192597

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3776 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-3776-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin March 26, 2024 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : nodejs Version : 10.24.0~dfsg-1~deb10u4 CVE ID : CVE-2023-30590 CVE-2023-46809 CVE-2024-22025 Debian Bug : 1039990 1064055

Vulnerabilities have been found in Node.js, which could lead to denial of service or information disclosure.

CVE-2023-30590

Ben Smyth reported an inconsistency between implementation and documented design of the The generateKeys() API function, which only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.
The documented behavior has been updated to reflect the current implementation.

CVE-2023-46809

It was discovered that Node.js was vulnerable to the Marvin Attack, allowing a covert timing side-channel during PKCS#1 v1.5 padding error handling. An attacker could remotely exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios involving API endpoints processing Json Web Encryption messages.
The fix disables RSA_PKCS1_PADDING for crypto.privateDecrypt(), and includes a security revert flag that can be used to restore support (and the vulnerability).

CVE-2024-22025

It was discovered that Node.js was vulnerable to Denial of Service by resource exhaustion in fetch() brotli decoding.

For Debian 10 buster, these problems have been fixed in version 10.24.0~dfsg-1~deb10u4.

We recommend that you upgrade your nodejs packages.

For the detailed security status of nodejs please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/nodejs

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libnode-dev packages.

Plugin Details

Severity: High

ID: 192597

File Name: debian_DLA-3776.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 3/27/2024

Updated: 1/22/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2023-30590

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libnode64, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:nodejs-doc, p-cpe:/a:debian:debian_linux:libnode-dev, p-cpe:/a:debian:debian_linux:nodejs

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 3/26/2024

Vulnerability Publication Date: 6/20/2023

Reference Information

CVE: CVE-2023-30590, CVE-2023-46809, CVE-2024-22025

Detections

Analytics