CVE-2023-46809 Affecting nodejs-packaging package, versions <0:2021.06-4.module+el8.9.0+90082+b6a613a6
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE8-NODEJSPACKAGING-6508578
- published 28 Mar 2024
- disclosed 7 Sep 2024
Introduced: 28 Mar 2024
CVE-2023-46809 Open this link in a new tabHow to fix?
Upgrade Oracle:8 nodejs-packaging to version 0:2021.06-4.module+el8.9.0+90082+b6a613a6 or higher.
This issue was patched in ELSA-2024-1687.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nodejs-packaging package and not the nodejs-packaging package as distributed by Oracle.
See How to fix? for Oracle:8 relevant fixed versions and status.
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.