When the Node.js policy feature checks the integrity of a resource against a trusted manifest the application can intercept the operation and return a forged checksum to the node's policy implementation thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and 20.x. Please note that at the time this CVE was issued the policy mechanism is an experimental feature of Node.js.

🗓️ 23 Oct 2023 07:00:00Reported by MicrosoftType

The Node.js policy feature can be intercepted to forge checksums, disabling integrity checks for users of the experimental policy mechanism in eighteen and twenty releases.

Reporter	Title	Published	Views	Family All 172
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to security restrictions bypass due to [CVE-2023-38552], [CVE-2023-39333]	14 Dec 202310:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.14 and earlier	19 Jan 202418:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	16 Nov 202314:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	17 Sep 202417:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor	17 Jan 202407:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for November 2023.	26 Mar 202504:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	6 Dec 202316:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local - Planning Analytics Workspace is affected by vulnerabilities in multiple Open Source Software (OSS) components	7 May 202419:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to Node.js	11 Dec 202309:42	–	ibm
Tenable Nessus	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-412)	4 Nov 202300:00	–	nessus

Vulners

Node

microsoft cbl2_nodejs18_18.18.2-2Range<18.18.2-2

23 Oct 2023 07:00Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00397

SSVC