CVE-2023-46809 Affecting nodejs-devel package, versions <1:20.11.1-1.module+el8.9.0+90250+089ba5e1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE8-NODEJSDEVEL-6508550
- published 28 Mar 2024
- disclosed 7 Sep 2024
Introduced: 28 Mar 2024
CVE-2023-46809 Open this link in a new tabHow to fix?
Upgrade Oracle:8 nodejs-devel to version 1:20.11.1-1.module+el8.9.0+90250+089ba5e1 or higher.
This issue was patched in ELSA-2024-1687.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nodejs-devel package and not the nodejs-devel package as distributed by Oracle.
See How to fix? for Oracle:8 relevant fixed versions and status.
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.