Description (CNA)
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NodeJS / Node | affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.*; affected 13.0 before 13.*; affected 14.0 before 14.21.3; affected 15.0 before 15.*; affected 16.0 before 16.19.1; affected 17.0 before 17.*; affected 18.0 before 18.14.1; affected 19.0 before 19.2.0 |
CWE
CWE-310
References
- https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/
- https://hackerone.com/reports/1808596
- https://security.netapp.com/advisory/ntap-20230316-0008/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.