Timing Side Channel Attack

🗓️ 21 Feb 2024 19:07:23Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 23 Views

NodeJS vulnerability - Timing Side Channel Attack in privateDecrypt() API with significant timing differences in decryption for valid and invalid ciphertexts, allowing remote exploitation to decrypt RSA ciphertexts and forge signatures in Json Web Encryption messages

Reporter	Title	Published	Views	Family All 183
IBM Security Bulletins	Security Bulletin: Node.js vulnerabilities affect IBM Spectrum Control	8 Jul 202409:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational® Application Developer for WebSphere® Software is vulnerable to a denial of service	13 May 202423:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Voice Gateway	1 Apr 202418:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to loss of confidentiality and denial of service due to [CVE-2023-46809] [CVE-2024-21892] [CVE-2024-22019]	23 Apr 202414:05	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service vulnerabilities in Node.js affects IBM Rational Developer for i RPG and COBOL + Modernization Tools, Java Edition	30 May 202418:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities	19 Mar 202417:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js affect IBM Business Automation Workflow	1 Mar 202419:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.15 and earlier	19 Mar 202420:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js.	10 May 202414:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202502:46	–	ibm

Vulners

Node

nodejs nodejsMatch12.19.0~dfsg-1debian

AND

debian debian_linuxMatch999

nodejs nodejsMatch10.24.0~dfsg-1~deb10u1debian

AND

nodejs nodejsMatch10.21.0~dfsg-1~deb10u1debian

AND

debian debian_linuxMatch10

nodejs nodejsMatch12.19.0~dfsg-1debian

AND

debian debian_linuxMatch11

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-46809
nodejs	www.nodejs.org/en/blog/vulnerability/february-2024-security-releases

05 Apr 2024 13:22Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.17.4

EPSS0.01239

SSVC