Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 stack clear bug causing DoS
CVE-2023-23919 Published on February 23, 2023

A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

NVD

A proof of concept, or POC exists for this vulnerability which can be automated.

Vulnerability Analysis

CVE-2023-23919 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Exploitation:

POC

Automatable:

YES

Technical Impact:

PARTIAL

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

NONE

Integrity Impact:

NONE

Availability Impact:

HIGH

Weakness Type

Cryptographic Issues

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Products Associated with CVE-2023-23919

stack.watch emails you whenever new vulnerabilities are published in nodejs node.js or Canonical Ubuntu Linux. Just hit a watch button to start following.

nodejs node.js

  Watch

Canonical Ubuntu Linux

  Watch

Affected Versions

• Version 4.0 and below 4.* is affected.
• Version 5.0 and below 5.* is affected.
• Version 6.0 and below 6.* is affected.
• Version 7.0 and below 7.* is affected.
• Version 8.0 and below 8.* is affected.
• Version 9.0 and below 9.* is affected.
• Version 10.0 and below 10.* is affected.
• Version 11.0 and below 11.* is affected.
• Version 12.0 and below 12.* is affected.
• Version 13.0 and below 13.* is affected.
• Version 14.0 and below 14.21.3 is affected.
• Version 15.0 and below 15.* is affected.
• Version 16.0 and below 16.19.1 is affected.
• Version 17.0 and below 17.* is affected.
• Version 18.0 and below 18.14.1 is affected.
• Version 19.0 and below 19.2.0 is affected.

Exploit Probability