Various node:fs functions allow specifying paths as either strings or Uint8Array objects. In Node.js environments, the Buffer class extends the Uint8Array class. Node.js prevents path traversal through strings (see CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through non-Buffer Uint8Array objects. References: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases
Created nodejs tracking bugs for this issue: Affects: epel-7 [bug 2244452] Affects: fedora-37 [bug 2244459] Created nodejs16 tracking bugs for this issue: Affects: fedora-38 [bug 2244454] Created nodejs18 tracking bugs for this issue: Affects: fedora-38 [bug 2244456] Created nodejs20 tracking bugs for this issue: Affects: fedora-38 [bug 2244453] Created nodejs:13/nodejs tracking bugs for this issue: Affects: epel-8 [bug 2244461] Created nodejs:14/nodejs tracking bugs for this issue: Affects: fedora-37 [bug 2244458] Created nodejs:16-epel/nodejs tracking bugs for this issue: Affects: epel-8 [bug 2244460] Created nodejs:16/nodejs tracking bugs for this issue: Affects: fedora-38 [bug 2244455] Created nodejs:18/nodejs tracking bugs for this issue: Affects: fedora-37 [bug 2244457]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7205 https://access.redhat.com/errata/RHSA-2023:7205
Created nodejs tracking bugs for this issue: Affects: epel-7 [bug 2258564] Created nodejs20 tracking bugs for this issue: Affects: fedora-38 [bug 2258565]
It's amazing! Your article is very good and very useful to us! Thank you so much for taking the time to share with us! Have a good time with https://unoonlinegame.io free.
I would like to confirm that CVE-2023-39332 has been addressed in Red Hat Enterprise Linux 8 via RHSA-2023:7205. For other affected platforms, such as Fedora and EPEL, the associated tracking bugs (e.g., Bug 2244452 for EPEL 7 and Bug 2244459 for Fedora 37) indicate that patches are being managed accordingly.- https://geekydane.com
(In reply to eric conley from comment #11) > I would like to confirm that CVE-2023-39332 has been addressed in Red Hat > Enterprise Linux 8 via RHSA-2023:7205. For other affected platforms, such as > Fedora and EPEL, the associated tracking bugs (e.g., Bug 2244452 for EPEL 7 > and Bug 2244459 for Fedora 37) indicate that patches are being managed > accordingly.- https://geekydane.com Hello, The CVE-2023-39332 was fixed in nodejs version 20.8.1(https://nodejs.org/en/blog/vulnerability/october-2023-security-releases), which was then used by RHSA-2023:7205 as a re-base version. Connected jira-ticket (https://issues.redhat.com/browse/RHEL-13856)
CVE-2023-39332 was addressed in Node.js version 20.8.1 (see: Node.js Security Releases - October 2023), which subsequently served as the rebase version for RHSA-2023:7205.
This comment was flagged as spam, view the edit history to see the original text if required.
(In reply to Dhananjay Arunesh from comment #0) > Various node:fs functions allow specifying paths as either strings or > Uint8Array objects. In Node.js environments, the Buffer class extends the > Uint8Array class. Node.js prevents path traversal through strings (see > CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through > non-Buffer Uint8Array objects. > > References: > https://nodejs.org/en/blog/vulnerability/october-2023-security-releases > texttoolz.com This bug (CVE-2023-39332) describes a high severity path traversal vulnerability in Node.js: path traversal is possible through non-Buffer Uint8Array objects passed to node:fs functions. While Node.js blocks traversal via strings and Buffer objects, it failed for non-Buffer Uint8Array, leading to potential security risks. The issue was fixed in Node.js v20.8.1 and addressed by Red Hat in RHSA-2023:7205.
(In reply to andrewthecarter2025 from comment #15) > (In reply to Dhananjay Arunesh from comment #0) > > Various node:fs functions allow specifying paths as either strings or > > Uint8Array objects. In Node.js environments, the Buffer class extends the > > Uint8Array class. Node.js prevents path traversal through strings (see > > CVE-2023-30584) and Buffer objects (see CVE-2023-32004), but not through > > non-Buffer Uint8Array objects. > > > > References: > > https://nodejs.org/en/blog/vulnerability/october-2023-security-releases > > https://texttoolz.com > > This bug (CVE-2023-39332) describes a high severity path traversal > vulnerability in Node.js: path traversal is possible through non-Buffer > Uint8Array objects passed to node:fs functions. While Node.js blocks > traversal via strings and Buffer objects, it failed for non-Buffer > Uint8Array, leading to potential security risks. The issue was fixed in > Node.js v20.8.1 and addressed by Red Hat in RHSA-2023:7205.