CVE-2023-32002

描述

The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

如何修補 CVE-2023-32002

要修補 CVE-2023-32002,請將受影響套件升級到下列已修補版本。

• Alpine/nodejs—升級至 16.20.2-r0 或更新版本
• —升級至 16.20.2 或更新版本
• —升級至 16.20.2 或更新版本
• —未列出修補版本

CVE-2023-32002 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 16.20.2-r0
• from 0, < 16.20.2, >= 17.0.0, < 18.17.1, >= 19.0.0, < 20.5.1
• from 0, < 16.20.2, >= 17.0.0, < 18.17.1, >= 19.0.0, < 20.5.1
• from 0

CVSS 分數

參考連結(5)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-32002
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2023-32002
• WEBhackerone.com/reports/1960870
• WEBnvd.nist.gov/vuln/detail/CVE-2023-32002
• WEB