Description
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 12 | | =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || =18.19.0+dfsg-6 || =18.19.0+dfsg-6~deb12u1 || =18.19.0+dfsg-6~deb12u2 || =18.19.1+dfsg-1 || =18.19.1+dfsg-2 || =18.19.1+dfsg-3 || =18.19.1+dfsg-3.1 || =18.19.1+dfsg-4 || =18.19.1+dfsg-6 || =18.20.1+dfsg-1 || =18.20.1+dfsg-2 || =18.20.1+dfsg-3 || =18.20.1+dfsg-4 || >=0 <18.20.4+dfsg-1~deb12u1 | 18.20.4+dfsg-1~deb12u1 |
debian 13 | | | 18.19.1+dfsg-1 |
debian 14 | | | 18.19.1+dfsg-1 |
 rpm rhel8.8 | | <1:18.19.1-1.module+el8.8.0+21592+14a8b93e | 1:18.19.1-1.module+el8.8.0+21592+14a8b93e |
rpm rhel8 | | - | - |
rpm rhel9 | | - | - |
rpm rhel9.2 | | <1:18.19.1-1.module+el9.2.0+21594+a052107e | 1:18.19.1-1.module+el9.2.0+21594+a052107e |
