Vulnerability · Published Sep 7, 2024 · Assigned by hackerone
CVE-2023-46809
High 7.4
In plain English
A high-severity security flaw in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)1.3%top 29.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:18.19.1-1.module_el8.9.0+3753+4de0891b | ALSA-2024:1510 |
| AlmaLinux:8 | nodejs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs | 1:18.19.1-1.module_el9.3.0+59+28b95644 | ALSA-2024:1503 |
| AlmaLinux:9 | nodejs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-devel | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:8 | nodejs-devel | 1:18.19.1-1.module_el8.9.0+3753+4de0891b | ALSA-2024:1510 |
| AlmaLinux:9 | nodejs-devel | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:9 | nodejs-devel | 1:18.19.1-1.module_el9.3.0+59+28b95644 | ALSA-2024:1503 |
| AlmaLinux:8 | nodejs-docs | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:8 | nodejs-docs | 1:18.19.1-1.module_el8.9.0+3753+4de0891b | ALSA-2024:1510 |
| AlmaLinux:9 | nodejs-docs | 1:18.19.1-1.module_el9.3.0+59+28b95644 | ALSA-2024:1503 |
| AlmaLinux:9 | nodejs-docs | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.11.1-1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.19.1-1.module_el8.9.0+3753+4de0891b | ALSA-2024:1510 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.11.1-1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.19.1-1.module_el9.3.0+59+28b95644 | ALSA-2024:1503 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:1510 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:1688 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:1503 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:1510 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:1687 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:1503 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.3.0+48+1cf146a1 | ALSA-2024:1688 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:1687 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:1510 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+48+1cf146a1 | ALSA-2024:1688 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:1503 |
| AlmaLinux:8 | npm | 1:10.2.4-1.20.11.1.1.module_el8.9.0+3775+d8460d35 | ALSA-2024:1687 |
| AlmaLinux:8 | npm | 1:10.2.4-1.18.19.1.1.module_el8.9.0+3753+4de0891b | ALSA-2024:1510 |
| AlmaLinux:9 | npm | 1:10.2.4-1.18.19.1.1.module_el9.3.0+59+28b95644 | ALSA-2024:1503 |
| AlmaLinux:9 | npm | 1:10.2.4-1.20.11.1.1.module_el9.3.0+88+29afeaa2 | ALSA-2024:1688 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DEBIAN-CVE-2023-46809 |
| Debian:12 | nodejs | 18.20.4+dfsg-1~deb12u1 | DSA-5991-1 |
| Debian:13 | nodejs | 18.19.1+dfsg-1 | DEBIAN-CVE-2023-46809 |
| Debian:14 | nodejs | 18.19.1+dfsg-1 | DEBIAN-CVE-2023-46809 |
| Rocky Linux:8 | nodejs | 1:18.19.1-1.module+el8.9.0+1768+6b454dc0 | RLSA-2024:1510 |
| Rocky Linux:8 | nodejs | 1:20.11.1-1.module+el8.9.0+1776+addd4aec | RLSA-2024:1687 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:1510 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:1687 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:1688 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:1687 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:1510 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:1688 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:1503 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:1503 |
Affected products (as reported)
Weakness: CWE-385 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N