Vulnerability · Published Oct 18, 2023 · Assigned by hackerone

CVE-2023-38552

High 7.5

In plain English

A high-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.2%top 30.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	nodejs	1:18.18.2-1.module_el8.8.0+3652+0e111ba0	ALSA-2023:5869
AlmaLinux:8	nodejs	1:20.8.1-1.module_el8.9.0+3675+0258a6d9	ALSA-2023:7205
AlmaLinux:9	nodejs	1:18.18.2-2.module_el9.2.0+43+3ebc9e20	ALSA-2023:5849
AlmaLinux:8	nodejs-devel	1:20.8.1-1.module_el8.9.0+3675+0258a6d9	ALSA-2023:7205
AlmaLinux:8	nodejs-devel	1:18.18.2-1.module_el8.8.0+3652+0e111ba0	ALSA-2023:5869
AlmaLinux:9	nodejs-devel	1:18.18.2-2.module_el9.2.0+43+3ebc9e20	ALSA-2023:5849
AlmaLinux:8	nodejs-docs	1:20.8.1-1.module_el8.9.0+3675+0258a6d9	ALSA-2023:7205
AlmaLinux:8	nodejs-docs	1:18.18.2-1.module_el8.8.0+3652+0e111ba0	ALSA-2023:5869
AlmaLinux:9	nodejs-docs	1:18.18.2-2.module_el9.2.0+43+3ebc9e20	ALSA-2023:5849
AlmaLinux:8	nodejs-full-i18n	1:18.18.2-1.module_el8.8.0+3652+0e111ba0	ALSA-2023:5869
AlmaLinux:8	nodejs-full-i18n	1:20.8.1-1.module_el8.9.0+3675+0258a6d9	ALSA-2023:7205
AlmaLinux:9	nodejs-full-i18n	1:18.18.2-2.module_el9.2.0+43+3ebc9e20	ALSA-2023:5849
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.8.0+3613+1ed8c91d	ALSA-2023:5869
AlmaLinux:8	nodejs-nodemon	3.0.1-1.module_el8.9.0+3675+0258a6d9	ALSA-2023:7205
AlmaLinux:9	nodejs-nodemon	3.0.1-1.module_el9.2.0+36+853e48f5	ALSA-2023:5849
AlmaLinux:8	nodejs-packaging	2021.06-4.module_el8.7.0+3343+ea2b7901	ALSA-2023:5869
AlmaLinux:8	nodejs-packaging	2021.06-4.module_el8.9.0+3684+11b9e959	ALSA-2023:7205
AlmaLinux:9	nodejs-packaging	2021.06-4.module_el9.1.0+13+d9a595ea	ALSA-2023:5849
AlmaLinux:8	nodejs-packaging-bundler	2021.06-4.module_el8.7.0+3343+ea2b7901	ALSA-2023:5869
AlmaLinux:8	nodejs-packaging-bundler	2021.06-4.module_el8.9.0+3684+11b9e959	ALSA-2023:7205
AlmaLinux:9	nodejs-packaging-bundler	2021.06-4.module_el9.1.0+13+d9a595ea	ALSA-2023:5849
AlmaLinux:8	npm	1:10.1.0-1.20.8.1.1.module_el8.9.0+3675+0258a6d9	ALSA-2023:7205
AlmaLinux:8	npm	1:9.8.1-1.18.18.2.1.module_el8.8.0+3652+0e111ba0	ALSA-2023:5869
AlmaLinux:9	npm	1:9.8.1-1.18.18.2.2.module_el9.2.0+43+3ebc9e20	ALSA-2023:5849
Alpine:v3.20	nodejs	18.18.2-r0	ALPINE-CVE-2023-38552
Alpine:v3.21	nodejs	18.18.2-r0	ALPINE-CVE-2023-38552
Alpine:v3.22	nodejs	18.18.2-r0	ALPINE-CVE-2023-38552
Alpine:v3.23	nodejs	18.18.2-r0	ALPINE-CVE-2023-38552
Alpine:v3.24	nodejs	18.18.2-r0	ALPINE-CVE-2023-38552
Alpine:v3.20	nodejs-current	20.8.1-r0	ALPINE-CVE-2023-38552
Alpine:v3.21	nodejs-current	20.8.1-r0	ALPINE-CVE-2023-38552
Alpine:v3.22	nodejs-current	20.8.1-r0	ALPINE-CVE-2023-38552
Alpine:v3.23	nodejs-current	20.8.1-r0	ALPINE-CVE-2023-38552
Alpine:v3.24	nodejs-current	20.8.1-r0	ALPINE-CVE-2023-38552
Debian:12	nodejs	18.19.0+dfsg-6~deb12u1	DSA-5589-1
Debian:12	nodejs	18.19.0+dfsg-6~deb12u1	DEBIAN-CVE-2023-38552
Debian:13	nodejs	18.13.0+dfsg1-1.1	DEBIAN-CVE-2023-38552
Debian:14	nodejs	18.13.0+dfsg1-1.1	DEBIAN-CVE-2023-38552
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1988+437f3d23	RLSA-2023:5869
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1989+e60144d9	RLSA-2023:5869
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.9.0+1760+903d54b9	RLSA-2023:5869
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.8.0+1459+02651ab6	RLSA-2023:7205
Rocky Linux:8	nodejs-nodemon	0:3.0.1-1.module+el8.10.0+1824+532140ee	RLSA-2023:5869
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40017+f0db1785	RLSA-2023:5849
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40022+9ecc286c	RLSA-2023:5849
Rocky Linux:9	nodejs-nodemon	0:3.0.1-1.module+el9.7.0+40018+a011993d	RLSA-2023:5849
Rocky Linux:8	nodejs-packaging	0:2021.06-4.module+el8.7.0+1072+5b168780	RLSA-2023:7205
Rocky Linux:8	nodejs-packaging	0:2021.06-4.module+el8.10.0+1989+e60144d9	RLSA-2023:5869
Rocky Linux:8	nodejs-packaging	0:2021.06-4.module+el8.10.0+1824+532140ee	RLSA-2023:5869
Rocky Linux:8	nodejs-packaging	0:2021.06-4.module+el8.10.0+1988+437f3d23	RLSA-2023:5869
Rocky Linux:9	nodejs-packaging	0:2021.06-4.module+el9.7.0+40018+a011993d	RLSA-2023:5849
Rocky Linux:9	nodejs-packaging	0:2021.06-4.module+el9.7.0+40022+9ecc286c	RLSA-2023:5849
Rocky Linux:9	nodejs-packaging	0:2021.06-4.module+el9.7.0+40025+0e0cf6b2	RLSA-2023:5849
Rocky Linux:9	nodejs-packaging	0:2021.06-4.module+el9.7.0+40017+f0db1785	RLSA-2023:5849

Affected products (as reported)

Vendor	Product	Versions
NodeJS	Node	4.0 – before 4.5.0 – before 5.6.0 – before 6.7.0 – before 7.8.0 – before 8.9.0 – before 9.10.0 – before 10.11.0 – before 11.

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References