The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4536 advisory.

    - Rebase to 18.16.1       Resolves: rhbz#2188290 rhbz#2166926       Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3408-1 advisory.

    - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150).
    - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire()     (bsc#1214156).
    - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
    - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574).
    - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2662-1 advisory.

    Update to version 18.16.1:

    - CVE-2023-30581: Fixed mainModule.__proto__ Bypass Experimental Policy Mechanism (bsc#1212574).
    - CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js     installer repair process (bsc#1212579).
    - CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates     (bsc#1212581).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
    - CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
    - CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE     (bsc#1211607).
    - CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
    - CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
    - CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).
    - CVE-2022-25881: Fixed a Regular Expression Denial of Service (bsc#1208744).

    Bug fixes:

    - Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build     failures on some platforms, like s390x in Factory. (bsc#1211407)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2861-1 advisory.

    Update to version 16.20.1:

    - CVE-2023-30581: Fixed mainModule.__proto__ Bypass Experimental Policy Mechanism (bsc#1212574).
    - CVE-2023-30585: Fixed privilege escalation via Malicious Registry Key manipulation during Node.js     installer repair process (bsc#1212579).
    - CVE-2023-30588: Fixed process interuption due to invalid Public Key information in x509 certificates     (bsc#1212581).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via empty headers separated by CR (bsc#1212582).
    - CVE-2023-30590: Fixed DiffieHellman key generation after setting a private key (bsc#1212583).
    - CVE-2023-31124: Fixed cross compilation issue with AutoTools that does not set CARES_RANDOM_FILE     (bsc#1211607).
    - CVE-2023-31130: Fixed buffer underwrite problem in ares_inet_net_pton() (bsc#1211606).
    - CVE-2023-31147: Fixed insufficient randomness in generation of DNS query IDs (bsc#1211605).
    - CVE-2023-32067: Fixed denial-of-service via 0-byte UDP payload (bsc#1211604).

    Bug fixes:

    - Increased the default timeout on unit tests from 2 to 20 minutes. This seems to have lead to build     failures on some platforms, like s390x in Factory. (bsc#1211407)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nodejs package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4536 advisory.

  - The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require     modules outside of the policy.json definition. This vulnerability affects all users using the experimental     policy mechanism in all active release lines: v16, v18 and, v20. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js (CVE-2023-30581)

  - When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20. (CVE-2023-30588)

  - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit     HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient     to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence     should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20     (CVE-2023-30589)

  - The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet, but the function is     also needed to compute the corresponding public key after calling setPrivateKey(). However, the     documentation says this API call: Generates private and public Diffie-Hellman key values. The documented     behavior is very different from the actual behavior, and this difference could easily lead to security     issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-     level security, implications are consequently broad. (CVE-2023-30590)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4536 advisory.

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)
    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)
    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)
    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-237 advisory.

    The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules     outside of the policy.json definition.

    This vulnerability affects all users using the experimental policy mechanism in all active release lines:
    16.x, 18.x and, 20.x.

    Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
    (CVE-2023-30581)

    When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a     non-expect termination occurs making it susceptible to DoS attacks when the attacker could force     interruptions of application processing, as the process terminates when accessing public key info of     provided certificates from user code. The current context of the users will be gone, and that will cause a     DoS scenario.

    This vulnerability affects all active Node.js versions v16, v18, and, v20. (CVE-2023-30588)

    The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP     requests. This can lead to HTTP Request Smuggling (HRS).

    The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According     to RFC7230 section 3, only the CRLF sequence should delimit each header-field.

    This vulnerability impacts all Node.js active versions: v16, v18, and, v20. (CVE-2023-30589)

    The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or     outdated) keys, that is, it only generates a private key if none has been set yet.

    However, the documentation says this API call: Generates private and public Diffie-Hellman key values.

    The documented behavior is different from the actual behavior, and this difference could easily lead to     security issues in applications that use these APIs as the DiffieHellman may be used as the basis for     application-level security.

    Please note that this is a documentation change an the vulnerability has been classified under CWE-1068 -     Inconsistency Between Implementation and Documented Design. This change applies to all Node.js active     versions: v16, v18, and, v20. (CVE-2023-30590)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-61e40652be advisory.

    ## 2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS

    This is a security release.

    ### Notable Changes

    The following CVEs are fixed in this release:

    * [CVE-2023-30581](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30581): `mainModule.__proto__`     Bypass Experimental Policy Mechanism (High)
    * [CVE-2023-30585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30585): Privilege escalation     via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
    * [CVE-2023-30588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30588): Process interuption due     to invalid Public Key information in x509 certificates (Medium)
    * [CVE-2023-30589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30589): HTTP Request Smuggling     via Empty headers separated by CR (Medium)
    * [CVE-2023-30590](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30590): DiffieHellman does not     generate keys after setting a private key (Medium)
    * OpenSSL Security Releases
      * [OpenSSL security advisory 28th March](https://www.openssl.org/news/secadv/20230328.txt).
      * [OpenSSL security advisory 20th April](https://www.openssl.org/news/secadv/20230420.txt).
      * [OpenSSL security advisory 30th May](https://www.openssl.org/news/secadv/20230530.txt)
    * c-ares vulnerabilities:
      * [GHSA-9g78-jv2r-p7vc](https://github.com/c-ares/c-ares/security/advisories/GHSA-9g78-jv2r-p7vc)
      * [GHSA-8r8p-23f3-64c2](https://github.com/c-ares/c-ares/security/advisories/GHSA-8r8p-23f3-64c2)
      * [GHSA-54xr-f67r-4pc4](https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4)
      * [GHSA-x6mf-cxr9-8q6v](https://github.com/c-ares/c-ares/security/advisories/GHSA-x6mf-cxr9-8q6v)

    More detailed information on each of the vulnerabilities can be found in [June 2023 Security     Releases](https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/) blog post.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-ad76deb86e advisory.

    Update `llhttp` to 8.1.1 and `python-aiohttp` to 3.8.5. Fixes CVE-2023-30589.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4537 advisory.

    - Rebase to 16.20.1       Resolves: rhbz#2188289       Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4537 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (16.20.1). (BZ#2223678, BZ#2223680,     BZ#2223682, BZ#2223684, BZ#2223686, BZ#2223688)

    Security Fix(es):

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4330 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (18). (BZ#2223314, BZ#2223316,     BZ#2223318, BZ#2223319, BZ#2223320, BZ#2223354)

    Security Fix(es):

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3306-1 advisory.

    - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150).
    - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire()     (bsc#1214156).
    - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
    - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574).
    - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583).
    - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5533 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The package has been upgraded to a later upstream version: nodejs (16.20.2).

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2236435, BZ#2178078, BZ#2223335)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
179861	Oracle Linux 8 : nodejs:18 (ELSA-2023-4536)	Nessus	Oracle Linux Local Security Checks	2023/8/15	2026/2/24	high
180142	SUSE SLES15 / openSUSE 15 Security Update : nodejs14 (SUSE-SU-2023:3408-1)	Nessus	SuSE Local Security Checks	2023/8/24	2026/6/26	critical
177699	SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2023:2662-1)	Nessus	SuSE Local Security Checks	2023/6/28	2026/6/26	high
178412	SUSE SLES15 Security Update : nodejs16 (SUSE-SU-2023:2861-1)	Nessus	SuSE Local Security Checks	2023/7/18	2026/6/25	high
203988	Photon OS 3.0: Nodejs PHSA-2023-3.0-0606	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
236956	Photon OS 4.0: Nodejs PHSA-2025-4.0-0801	Nessus	PhotonOS Local Security Checks	2025/5/20	2025/5/20	critical
179460	CentOS 8 : nodejs:18 (CESA-2023:4536)	Nessus	CentOS Local Security Checks	2023/8/8	2024/2/8	high
179625	AlmaLinux 8 : nodejs:18 (ALSA-2023:4536)	Nessus	Alma Linux Local Security Checks	2023/8/9	2025/1/13	high
178606	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-237)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	high
178701	Fedora 37 : nodejs16 (2023-61e40652be)	Nessus	Fedora Local Security Checks	2023/7/21	2024/11/14	high
185315	Fedora 39 : llhttp / python-aiohttp (2023-ad76deb86e)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	high
179855	Oracle Linux 8 : nodejs:16 (ELSA-2023-4537)	Nessus	Oracle Linux Local Security Checks	2023/8/15	2026/2/24	high
179474	RHEL 8 : nodejs:16 (RHSA-2023:4537)	Nessus	Red Hat Local Security Checks	2023/8/8	2024/11/7	high
179056	RHEL 9 : nodejs:18 (RHSA-2023:4330)	Nessus	Red Hat Local Security Checks	2023/7/31	2024/11/7	high
179823	SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2023:3306-1)	Nessus	SuSE Local Security Checks	2023/8/15	2026/6/26	critical
182781	RHEL 9 : nodejs (RHSA-2023:5533)	Nessus	Red Hat Local Security Checks	2023/10/9	2024/11/7	critical
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/5/8	2024/5/8	critical

检测

插件搜索

high

critical

high

high

high

critical

high

high

high

high

high

high

high

high

critical

critical

critical