CVE-2023-39331

2023-10-1804:15:11

Alpine Linux Development Team

security.alpinelinux.org

cve-2023-39331

vulnerability

patch

insufficiency

path traversal

protection

overwriting

utility functions

user-defined

implementation

experimental feature

node.js

unix

0.001 Low

EPSS

Percentile

21.1%

JSON

A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

OSVersionArchitecturePackageVersionFilename
Alpine3.16-mainnoarchnodejs= 16.20.2-r0UNKNOWN
Alpine3.15-mainnoarchnodejs= 16.20.2-r0UNKNOWN
Alpine3.18-mainnoarchnodejs= 18.20.1-r0UNKNOWN
Alpine3.17-mainnoarchnodejs= 18.20.1-r0UNKNOWN
Alpineedge-communitynoarchnodejs-current< 20.8.1-r0UNKNOWN
Alpine3.18-communitynoarchnodejs-current< 20.8.1-r0UNKNOWN
Alpine3.19-communitynoarchnodejs-current< 20.8.1-r0UNKNOWN
Alpine3.20-communitynoarchnodejs-current< 20.8.1-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	3.16-main	noarch	nodejs	= 16.20.2-r0	UNKNOWN
Alpine	3.15-main	noarch	nodejs	= 16.20.2-r0	UNKNOWN
Alpine	3.18-main	noarch	nodejs	= 18.20.1-r0	UNKNOWN
Alpine	3.17-main	noarch	nodejs	= 18.20.1-r0	UNKNOWN
Alpine	edge-community	noarch	nodejs-current	< 20.8.1-r0	UNKNOWN
Alpine	3.18-community	noarch	nodejs-current	< 20.8.1-r0	UNKNOWN
Alpine	3.19-community	noarch	nodejs-current	< 20.8.1-r0	UNKNOWN
Alpine	3.20-community	noarch	nodejs-current	< 20.8.1-r0	UNKNOWN