USN-6735-1: Node.js vulnerabilities

Packages

nodejs - An open-source, cross-platform JavaScript runtime environment.

Details

It was discovered that Node.js incorrectly handled the use of invalid public
keys while creating an x509 certificate. If a user or an automated system were
tricked into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause a denial of service. This issue only affected
Ubuntu 23.10. (CVE-2023-30588)

It was discovered that Node.js incorrectly handled the use of CRLF sequences to
delimit HTTP requests. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to obtain unauthorised access. This issue only affected
Ubuntu 23.10. (CVE-2023-30589)

It was discovered that Node.js incorrectly described the generateKeys()
function in the documentation. This inconsistency could possibly lead to
security issues in applications that use...

It was discovered that Node.js incorrectly handled the use of invalid public
keys while creating an x509 certificate. If a user or an automated system were
tricked into opening a specially crafted input file, a remote attacker could
possibly use this issue to cause a denial of service. This issue only affected
Ubuntu 23.10. (CVE-2023-30588)

It was discovered that Node.js incorrectly handled the use of CRLF sequences to
delimit HTTP requests. If a user or an automated system were tricked into
opening a specially crafted input file, a remote attacker could possibly use
this issue to obtain unauthorised access. This issue only affected
Ubuntu 23.10. (CVE-2023-30589)

It was discovered that Node.js incorrectly described the generateKeys()
function in the documentation. This inconsistency could possibly lead to
security issues in applications that use these APIs.
(CVE-2023-30590)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
23.10 mantic	libnode-dev – 18.13.0+dfsg1-1ubuntu2.2
	libnode108 – 18.13.0+dfsg1-1ubuntu2.2
	nodejs – 18.13.0+dfsg1-1ubuntu2.2
	nodejs-doc – 18.13.0+dfsg1-1ubuntu2.2
22.04 jammy	libnode-dev – 12.22.9~dfsg-1ubuntu3.5
	libnode72 – 12.22.9~dfsg-1ubuntu3.5
	nodejs – 12.22.9~dfsg-1ubuntu3.5
	nodejs-doc – 12.22.9~dfsg-1ubuntu3.5
20.04 focal	libnode-dev – 10.19.0~dfsg-3ubuntu1.6
	libnode64 – 10.19.0~dfsg-3ubuntu1.6
	nodejs – 10.19.0~dfsg-3ubuntu1.6
	nodejs-doc – 10.19.0~dfsg-3ubuntu1.6
18.04 bionic	nodejs – 8.10.0~dfsg-2ubuntu0.4+esm5
	nodejs-dev – 8.10.0~dfsg-2ubuntu0.4+esm5
	nodejs-doc – 8.10.0~dfsg-2ubuntu0.4+esm5
16.04 xenial	nodejs – 4.2.6~dfsg-1ubuntu4.2+esm3
	nodejs-dev – 4.2.6~dfsg-1ubuntu4.2+esm3
	nodejs-legacy – 4.2.6~dfsg-1ubuntu4.2+esm3
14.04 trusty	nodejs – 0.10.25~dfsg2-2ubuntu1.2+esm2
	nodejs-dev – 0.10.25~dfsg2-2ubuntu1.2+esm2
	nodejs-legacy – 0.10.25~dfsg2-2ubuntu1.2+esm2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References