Bug 2219838 (CVE-2023-30588) - CVE-2023-30588 nodejs: process interuption due to invalid Public Key information in x509 certificates
Summary: CVE-2023-30588 nodejs: process interuption due to invalid Public Key informat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-30588
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2220772 2220773 2220774 2220775 2220776 2220777 2220778 2220779 2220780 2220781 2220782 2220783 2223316 2223338 2223339 2223632 2223651 2223682 2223683
Blocks: 2217661
TreeView+ depends on / blocked
 
Reported: 2023-07-05 15:01 UTC by Dhananjay Arunesh
Modified: 2023-10-09 10:26 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability has been identified in the Node.js, where an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario.
Clone Of:
Environment:
Last Closed: 2023-08-08 13:16:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4330 0 None None None 2023-07-31 09:32:39 UTC
Red Hat Product Errata RHSA-2023:4331 0 None None None 2023-07-31 09:32:29 UTC
Red Hat Product Errata RHSA-2023:4536 0 None None None 2023-08-08 08:37:56 UTC
Red Hat Product Errata RHSA-2023:4537 0 None None None 2023-08-08 08:38:03 UTC
Red Hat Product Errata RHSA-2023:5361 0 None None None 2023-09-26 14:50:37 UTC
Red Hat Product Errata RHSA-2023:5533 0 None None None 2023-10-09 10:26:45 UTC

Description Dhananjay Arunesh 2023-07-05 15:01:41 UTC 
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario.

References:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
Comment 1 Dhananjay Arunesh 2023-07-06 05:28:53 UTC 
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 2220777]
Affects: fedora-all [bug 2220775]


Created nodejs:14/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220774]


Created nodejs:16-epel/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2220776]


Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220773]


Created nodejs:18/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220772]
Comment 4 errata-xmlrpc 2023-07-31 09:32:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4331 https://access.redhat.com/errata/RHSA-2023:4331
Comment 5 errata-xmlrpc 2023-07-31 09:32:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4330 https://access.redhat.com/errata/RHSA-2023:4330
Comment 6 errata-xmlrpc 2023-08-08 08:37:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4536 https://access.redhat.com/errata/RHSA-2023:4536
Comment 7 errata-xmlrpc 2023-08-08 08:38:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4537 https://access.redhat.com/errata/RHSA-2023:4537
Comment 8 Product Security DevOps Team 2023-08-08 13:16:01 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-30588
Comment 9 errata-xmlrpc 2023-09-26 14:50:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:5361 https://access.redhat.com/errata/RHSA-2023:5361
Comment 10 errata-xmlrpc 2023-10-09 10:26:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533
Note You need to log in before you can comment on or make changes to this bug.