CVE-2023-23920
MEDIUM4.2EPSS 0.08%nodejs - security update
發布日:2023/2/23修改日:2025/12/3
也稱為:ALPINE-CVE-2023-23920
描述
An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.
受影響套件(5)
- Alpine/nodejsfrom 0, < 14.21.3-r0
- Bitnami/node>= 14.0.0, < 14.21.3, >= 16.0.0, < 16.19.1, >= 18.0.0, < 18.14.1, >= 19.0.0, < 19.6.1
- Bitnami/node-min>= 14.0.0, < 14.21.3, >= 16.0.0, < 16.19.1, >= 18.0.0, < 18.14.1, >= 19.0.0, < 19.6.1
- Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u4
- Debian/nodejsfrom 0, < 12.22.12~dfsg-1~deb11u4
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N |
參考連結(7)
- ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2023-23920
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2023-23920
- WEBhttps://lists.debian.org/debian-lts-announce/2023/02/msg00038.html
- WEBhttps://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
- WEBhttps://nvd.nist.gov/vuln/detail/CVE-2023-23920
- WEBhttps://security.netapp.com/advisory/ntap-20230316-0008/
- WEBhttps://www.debian.org/security/2023/dsa-5395