CVE-2023-46809

Published: Sep 7, 2024Modified: Jun 17, 2026Deferred

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

Related CWEs

CWE-385

Covert Timing Channel

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

References (3)

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases

Source: support@hackerone.com

https://lists.debian.org/debian-lts-announce/2024/03/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.