A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs-current | Aug 22, 2024 | Jul 14, 2022 |
| Amazon_linux_2023 | — | Upgrade v8-develUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-libsUpgrade nodejs-libs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-devel | Feb 17, 2025 | Jul 8, 2022 |
| Freebsd | — | Upgrade nodeUpgrade node14Upgrade node16 | Nov 4, 2022 | Jul 8, 2022 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | May 10, 2024 | Jul 14, 2022 |
| Oracle_linux | — | Upgrade graalvm22-ce-17-native-image-llvm-backendUpgrade graalvm22-ce-17-libpolyglotUpgrade graalvm22-ce-11-develUpgrade graalvm22-ce-17-llvmUpgrade graalvm22-ce-11-pythonUpgrade graalvm22-ce-11-python-develUpgrade graalvm22-ce-17-polyglotUpgrade graalvm22-ce-17-espresso-llvmUpgrade graalvm22-ce-11-javascriptUpgrade graalvm22-ce-17-rubyUpgrade graalvm22-ce-11-native-imageUpgrade graalvm22-ce-17-javascriptUpgrade graalvm22-ce-11-espressoUpgrade graalvm22-ce-11-polyglotUpgrade graalvm22-ce-17Upgrade graalvm22-ce-11-wasmUpgrade graalvm22-ce-17-nodejs-develUpgrade graalvm22-ce-17-espressoUpgrade graalvm22-ce-17-llvm-toolchainUpgrade graalvm22-ce-11-espresso-llvmUpgrade graalvm22-ce-17-pythonUpgrade graalvm22-ce-17-jdkUpgrade graalvm22-ce-11-native-image-llvm-backendUpgrade graalvm22-ce-17-python-develUpgrade graalvm22-ce-17-develUpgrade graalvm22-ce-11-rubyUpgrade graalvm22-ce-17-toolsUpgrade graalvm22-ce-11-nodejs-develUpgrade graalvm22-ce-11-nodejsUpgrade graalvm22-ce-11-llvmUpgrade graalvm22-ce-11-jdkUpgrade graalvm22-ce-11-libpolyglotUpgrade graalvm22-ce-11-fastrUpgrade graalvm22-ce-11-ruby-develUpgrade graalvm22-ce-17-nodejsUpgrade graalvm22-ce-17-fastrUpgrade graalvm22-ce-11Upgrade graalvm22-ce-17-ruby-develUpgrade graalvm22-ce-11-llvm-toolchainUpgrade graalvm22-ce-17-wasmUpgrade graalvm22-ce-11-toolsUpgrade graalvm22-ce-17-native-image | Oct 16, 2024 | Jul 8, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub