CVE-2023-32559 Affecting nodejs-nodemon package, versions <0:3.0.1-1.module+el9.2.0+21169+1d24b6cc


Severity

Recommended
0.0
high
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.08% (37th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-NODEJSNODEMON-5922071
  • published28 Sept 2023
  • disclosed24 Aug 2023

Introduced: 24 Aug 2023

CVE-2023-32559  (opens in a new tab)

How to fix?

Upgrade Oracle:9 nodejs-nodemon to version 0:3.0.1-1.module+el9.2.0+21169+1d24b6cc or higher.
This issue was patched in ELSA-2023-5363.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nodejs-nodemon package and not the nodejs-nodemon package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding(&#39;spawn_sync&#39;) run arbitrary code, outside of the limits defined in a policy.json file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.

CVSS Scores

version 3.1