Fluid Attacks Database

Description

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	nodejs	=18.13.0+dfsg1-1 \|\| =18.13.0+dfsg1-1.1 \|\| =18.19.0+dfsg-1 \|\| =18.19.0+dfsg-2 \|\| =18.19.0+dfsg-3 \|\| =18.19.0+dfsg-4 \|\| =18.19.0+dfsg-5 \|\| >=0 <18.19.0+dfsg-6~deb12u1	18.19.0+dfsg-6~deb12u1
debian 11	nodejs	=12.21.0~dfsg-5 \|\| =12.22.10~dfsg-1 \|\| =12.22.10~dfsg-2 \|\| =12.22.12~dfsg-1~deb11u1 \|\| =12.22.12~dfsg-1~deb11u2 \|\| =12.22.12~dfsg-1~deb11u3 \|\| =12.22.12~dfsg-1~deb11u4 \|\| =12.22.4~dfsg-1 \|\| =12.22.5~dfsg-1 \|\| =12.22.5~dfsg-2 \|\| =12.22.5~dfsg-2~11u1 \|\| =12.22.5~dfsg-3 \|\| =12.22.5~dfsg-4 \|\| =12.22.5~dfsg-5 \|\| =12.22.5~dfsg-6 \|\| =12.22.5~dfsg-7 \|\| =12.22.7~dfsg-1 \|\| =12.22.7~dfsg-2 \|\| =12.22.9~dfsg-1 \|\| >=0 <12.22.12~dfsg-1~deb11u5	12.22.12~dfsg-1~deb11u5
debian 13	nodejs	>=0 <18.13.0+dfsg1-1.1	18.13.0+dfsg1-1.1
debian 14	nodejs	>=0 <18.13.0+dfsg1-1.1	18.13.0+dfsg1-1.1
rpm rhel8	nodejs	-	-
rpm rhel8.6	nodejs	<1:16.20.2-2.module+el8.6.0+19897+9590a839	1:16.20.2-2.module+el8.6.0+19897+9590a839
rpm rhel9	nodejs	<1:16.20.1-1.el9_2	1:16.20.1-1.el9_2
rpm rhel9.0	nodejs	<1:16.20.2-1.el9_0	1:16.20.2-1.el9_0
npm	node	>=16.0.0 <16.20.1 \|\| >=18.0.0 <18.16.1 \|\| >=20.0.0 <20.3.1	16.20.1, 18.16.1, 20.3.1

Aliases

1. CVE-2023-305902. NVD-2023-305903. OSV-DEBIAN-2023-305904. OSV-2023-305905. GCVE-2023-305906. SECURITY-TRACKER-CVE-2023-305907. lists.debian.org8. lists.debian.org9. https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30590.json10. security.netapp.com

References

1. https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.