Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "nodejs-dbg": "4.2.6~dfsg-1ubuntu4.2+esm2", "nodejs-dev": "4.2.6~dfsg-1ubuntu4.2+esm2", "nodejs-dev-dbgsym": "4.2.6~dfsg-1ubuntu4.2+esm2", "nodejs": "4.2.6~dfsg-1ubuntu4.2+esm2", "nodejs-legacy": "4.2.6~dfsg-1ubuntu4.2+esm2", "nodejs-dbgsym": "4.2.6~dfsg-1ubuntu4.2+esm2" } ] }
{ "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "nodejs-dev": "8.10.0~dfsg-2ubuntu0.4+esm2", "nodejs-doc": "8.10.0~dfsg-2ubuntu0.4+esm2", "nodejs": "8.10.0~dfsg-2ubuntu0.4+esm2", "nodejs-dbgsym": "8.10.0~dfsg-2ubuntu0.4+esm2" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libnode64-dbgsym": "10.19.0~dfsg-3ubuntu1.1", "libnode64": "10.19.0~dfsg-3ubuntu1.1", "nodejs-doc": "10.19.0~dfsg-3ubuntu1.1", "nodejs": "10.19.0~dfsg-3ubuntu1.1", "libnode-dev": "10.19.0~dfsg-3ubuntu1.1", "nodejs-dbgsym": "10.19.0~dfsg-3ubuntu1.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "nodejs-doc": "12.22.9~dfsg-1ubuntu3", "libnode72": "12.22.9~dfsg-1ubuntu3", "nodejs": "12.22.9~dfsg-1ubuntu3", "libnode-dev": "12.22.9~dfsg-1ubuntu3", "libnode72-dbgsym": "12.22.9~dfsg-1ubuntu3", "nodejs-dbgsym": "12.22.9~dfsg-1ubuntu3" } ] }