Bug 2219824 (CVE-2023-30581) - CVE-2023-30581 nodejs: mainModule.proto bypass experimental policy mechanism
Summary: CVE-2023-30581 nodejs: mainModule.proto bypass experimental policy mechanism
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-30581
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2219825 2219826 2219827 2219828 2220685 2220686 2220687 2220688 2220689 2220690 2220691 2220692 2223314 2223336 2223337 2223631 2223650 2223680 2223681
Blocks: 2217661
TreeView+ depends on / blocked
 
Reported: 2023-07-05 14:48 UTC by Dhananjay Arunesh
Modified: 2023-10-09 10:26 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.
Clone Of:
Environment:
Last Closed: 2023-08-08 13:15:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4330 0 None None None 2023-07-31 09:32:38 UTC
Red Hat Product Errata RHSA-2023:4331 0 None None None 2023-07-31 09:32:29 UTC
Red Hat Product Errata RHSA-2023:4536 0 None None None 2023-08-08 08:37:53 UTC
Red Hat Product Errata RHSA-2023:4537 0 None None None 2023-08-08 08:38:02 UTC
Red Hat Product Errata RHSA-2023:5361 0 None None None 2023-09-26 14:50:37 UTC
Red Hat Product Errata RHSA-2023:5533 0 None None None 2023-10-09 10:26:45 UTC

Description Dhananjay Arunesh 2023-07-05 14:48:47 UTC 
The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

References:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
Comment 1 Dhananjay Arunesh 2023-07-05 14:49:30 UTC 
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 2219828]
Affects: fedora-all [bug 2219826]


Created nodejs:14/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2219825]


Created nodejs:16-epel/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2219827]
Comment 2 Dhananjay Arunesh 2023-07-06 04:48:23 UTC 
Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220686]


Created nodejs:18/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220685]
Comment 5 Jan Staněk 2023-07-11 15:03:43 UTC 
Upstream fix: https://github.com/nodejs/node/commit/daaa43ed967626b997439f3c708aae0925f8d85a
Comment 6 errata-xmlrpc 2023-07-31 09:32:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4331 https://access.redhat.com/errata/RHSA-2023:4331
Comment 7 errata-xmlrpc 2023-07-31 09:32:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4330 https://access.redhat.com/errata/RHSA-2023:4330
Comment 8 errata-xmlrpc 2023-08-08 08:37:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4536 https://access.redhat.com/errata/RHSA-2023:4536
Comment 9 errata-xmlrpc 2023-08-08 08:38:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4537 https://access.redhat.com/errata/RHSA-2023:4537
Comment 10 Product Security DevOps Team 2023-08-08 13:15:02 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-30581
Comment 11 errata-xmlrpc 2023-09-26 14:50:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:5361 https://access.redhat.com/errata/RHSA-2023:5361
Comment 12 errata-xmlrpc 2023-10-09 10:26:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533
Note You need to log in before you can comment on or make changes to this bug.