UBUNTU-CVE-2023-30590

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2023-30590

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-30590.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-30590

Related

Published

2023-11-28T20:15:00Z

Modified

2023-11-28T20:15:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey(). However, the documentation says this API call: "Generates private and public Diffie-Hellman key values". The documented behavior is very different from the actual behavior, and this difference could easily lead to security issues in applications that use these APIs as the DiffieHellman may be used as the basis for application-level security, implications are consequently broad.

References

Affected packages

Ubuntu:Pro:14.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.10.25~dfsg2-2ubuntu1.2+esm2

Affected versions

0.*

0.10.15~dfsg1-4

0.10.21~dfsg1-1

0.10.22~dfsg1-2

0.10.23~dfsg1-1

0.10.23~dfsg1-2

0.10.23~dfsg1-3

0.10.24~dfsg1-1

0.10.25~dfsg2-2

0.10.25~dfsg2-2ubuntu1

0.10.25~dfsg2-2ubuntu1.2

0.10.25~dfsg2-2ubuntu1.2+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2",
            "binary_name": "nodejs-dbg"
        },
        {
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2",
            "binary_name": "nodejs-dev"
        },
        {
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2",
            "binary_name": "nodejs-dev-dbgsym"
        },
        {
            "binary_version": "0.10.25~dfsg2-2ubuntu1.2+esm2",
            "binary_name": "nodejs-legacy"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.6~dfsg-1ubuntu4.2+esm3

Affected versions

0.*

0.10.25~dfsg2-2ubuntu1

4.*

4.2.2~dfsg-1

4.2.3~dfsg-1

4.2.4~dfsg-1ubuntu1

4.2.4~dfsg-2

4.2.6~dfsg-1ubuntu1

4.2.6~dfsg-1ubuntu4

4.2.6~dfsg-1ubuntu4.1

4.2.6~dfsg-1ubuntu4.2

4.2.6~dfsg-1ubuntu4.2+esm1

4.2.6~dfsg-1ubuntu4.2+esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3",
            "binary_name": "nodejs-dbg"
        },
        {
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3",
            "binary_name": "nodejs-dev"
        },
        {
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3",
            "binary_name": "nodejs-dev-dbgsym"
        },
        {
            "binary_version": "4.2.6~dfsg-1ubuntu4.2+esm3",
            "binary_name": "nodejs-legacy"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.10.0~dfsg-2ubuntu0.4+esm5

Affected versions

6.*

6.11.4~dfsg-1ubuntu1

6.11.4~dfsg-1ubuntu2

6.12.0~dfsg-1ubuntu1

6.12.0~dfsg-2ubuntu1

6.12.0~dfsg-2ubuntu2

8.*

8.10.0~dfsg-2

8.10.0~dfsg-2ubuntu0.2

8.10.0~dfsg-2ubuntu0.3

8.10.0~dfsg-2ubuntu0.4

8.10.0~dfsg-2ubuntu0.4+esm1

8.10.0~dfsg-2ubuntu0.4+esm2

8.10.0~dfsg-2ubuntu0.4+esm3

8.10.0~dfsg-2ubuntu0.4+esm4

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm5",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm5",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm5",
            "binary_name": "nodejs-dev"
        },
        {
            "binary_version": "8.10.0~dfsg-2ubuntu0.4+esm5",
            "binary_name": "nodejs-doc"
        }
    ]
}

Ubuntu:20.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

10.19.0~dfsg-3ubuntu1.6

Affected versions

10.*

10.15.2~dfsg-2ubuntu1

10.17.0~dfsg-2ubuntu4

10.17.0~dfsg-2ubuntu6

10.19.0~dfsg-3ubuntu1

10.19.0~dfsg-3ubuntu1.1

10.19.0~dfsg-3ubuntu1.2

10.19.0~dfsg-3ubuntu1.3

10.19.0~dfsg-3ubuntu1.5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "10.19.0~dfsg-3ubuntu1.6",
            "binary_name": "libnode-dev"
        },
        {
            "binary_version": "10.19.0~dfsg-3ubuntu1.6",
            "binary_name": "libnode64"
        },
        {
            "binary_version": "10.19.0~dfsg-3ubuntu1.6",
            "binary_name": "libnode64-dbgsym"
        },
        {
            "binary_version": "10.19.0~dfsg-3ubuntu1.6",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "10.19.0~dfsg-3ubuntu1.6",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "10.19.0~dfsg-3ubuntu1.6",
            "binary_name": "nodejs-doc"
        }
    ]
}

Ubuntu:22.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

12.22.9~dfsg-1ubuntu3.5

Affected versions

12.*

12.22.5~dfsg-5ubuntu1

12.22.7~dfsg-2ubuntu1

12.22.7~dfsg-2ubuntu3

12.22.9~dfsg-1ubuntu2

12.22.9~dfsg-1ubuntu3

12.22.9~dfsg-1ubuntu3.1

12.22.9~dfsg-1ubuntu3.2

12.22.9~dfsg-1ubuntu3.3

12.22.9~dfsg-1ubuntu3.4

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "12.22.9~dfsg-1ubuntu3.5",
            "binary_name": "libnode-dev"
        },
        {
            "binary_version": "12.22.9~dfsg-1ubuntu3.5",
            "binary_name": "libnode72"
        },
        {
            "binary_version": "12.22.9~dfsg-1ubuntu3.5",
            "binary_name": "libnode72-dbgsym"
        },
        {
            "binary_version": "12.22.9~dfsg-1ubuntu3.5",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "12.22.9~dfsg-1ubuntu3.5",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "12.22.9~dfsg-1ubuntu3.5",
            "binary_name": "nodejs-doc"
        }
    ]
}

Ubuntu:24.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

18.19.1+dfsg-2ubuntu4

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode-dev"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-doc"
        }
    ]
}