The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6735-1 advisory.

    It was discovered that Node.js incorrectly handled the use of invalid public keys while creating an x509     certificate. If a user or an automated system were tricked into opening a specially crafted input file, a     remote attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 23.10. (CVE-2023-30588)

    It was discovered that Node.js incorrectly handled the use of CRLF sequences to delimit HTTP requests. If     a user or an automated system were tricked into opening a specially crafted input file, a remote attacker     could possibly use this issue to obtain unauthorised access. This issue only affected

    Ubuntu 23.10. (CVE-2023-30589)

    It was discovered that Node.js incorrectly described the generateKeys() function in the documentation.
    This inconsistency could possibly lead to security issues in applications that use these APIs.
    (CVE-2023-30590)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : Node.js vulnerabilities (USN-6735-1)

high Nessus Plugin ID 193361

Version 1.1

Version 1.0

Version 1.1 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.0 Apr 16, 2024, 7:30 PM New Plugin Feed: 202404161930