Description
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 11 | | =12.21.0~dfsg-5 || =12.22.10~dfsg-1 || =12.22.10~dfsg-2 || =12.22.12~dfsg-1~deb11u1 || =12.22.12~dfsg-1~deb11u2 || =12.22.12~dfsg-1~deb11u3 || =12.22.12~dfsg-1~deb11u4 || =12.22.4~dfsg-1 || =12.22.5~dfsg-1 || =12.22.5~dfsg-2 || =12.22.5~dfsg-2~11u1 || =12.22.5~dfsg-3 || =12.22.5~dfsg-4 || =12.22.5~dfsg-5 || =12.22.5~dfsg-6 || =12.22.5~dfsg-7 || =12.22.7~dfsg-1 || =12.22.7~dfsg-2 || =12.22.9~dfsg-1 || >=0 <12.22.12~dfsg-1~deb11u5 | 12.22.12~dfsg-1~deb11u5 |
debian 12 | | =18.13.0+dfsg1-1 || =18.13.0+dfsg1-1.1 || =18.19.0+dfsg-1 || =18.19.0+dfsg-2 || =18.19.0+dfsg-3 || =18.19.0+dfsg-4 || =18.19.0+dfsg-5 || =18.19.0+dfsg-6 || =18.19.0+dfsg-6~deb12u1 || =18.19.0+dfsg-6~deb12u2 || =18.19.1+dfsg-1 || =18.19.1+dfsg-2 || =18.19.1+dfsg-3 || =18.19.1+dfsg-3.1 || =18.19.1+dfsg-4 || =18.19.1+dfsg-6 || =18.20.1+dfsg-1 || =18.20.1+dfsg-2 || =18.20.1+dfsg-3 || =18.20.1+dfsg-4 || >=0 <18.20.4+dfsg-1~deb12u1 | 18.20.4+dfsg-1~deb12u1 |
debian 13 | | | 18.19.1+dfsg-1 |
debian 14 | | | 18.19.1+dfsg-1 |
 rpm rhel8.8 | | <1:18.19.1-1.module+el8.8.0+21592+14a8b93e | 1:18.19.1-1.module+el8.8.0+21592+14a8b93e |
rpm rhel8 | | - | - |
rpm rhel9 | | - | - |
rpm rhel9.2 | | <1:18.19.1-1.module+el9.2.0+21594+a052107e | 1:18.19.1-1.module+el9.2.0+21594+a052107e |
