UBUNTU-CVE-2024-22018

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2024-22018
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-22018.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-22018
Related
Published
2024-07-10T02:15:00Z
Modified
2024-07-10T02:15:00Z
Summary
[none]
Details

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

References

Affected packages

Ubuntu:Pro:14.04:LTS / nodejs

Package

Name
nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.15~dfsg1-4
0.10.21~dfsg1-1
0.10.22~dfsg1-2
0.10.23~dfsg1-1
0.10.23~dfsg1-2
0.10.23~dfsg1-3
0.10.24~dfsg1-1
0.10.25~dfsg2-2
0.10.25~dfsg2-2ubuntu1
0.10.25~dfsg2-2ubuntu1.2
0.10.25~dfsg2-2ubuntu1.2+esm1
0.10.25~dfsg2-2ubuntu1.2+esm2

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / nodejs

Package

Name
nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.10.25~dfsg2-2ubuntu1

4.*

4.2.2~dfsg-1
4.2.3~dfsg-1
4.2.4~dfsg-1ubuntu1
4.2.4~dfsg-2
4.2.6~dfsg-1ubuntu1
4.2.6~dfsg-1ubuntu4
4.2.6~dfsg-1ubuntu4.1
4.2.6~dfsg-1ubuntu4.2
4.2.6~dfsg-1ubuntu4.2+esm1
4.2.6~dfsg-1ubuntu4.2+esm2
4.2.6~dfsg-1ubuntu4.2+esm3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / nodejs

Package

Name
nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.11.4~dfsg-1ubuntu1
6.11.4~dfsg-1ubuntu2
6.12.0~dfsg-1ubuntu1
6.12.0~dfsg-2ubuntu1
6.12.0~dfsg-2ubuntu2

8.*

8.10.0~dfsg-2
8.10.0~dfsg-2ubuntu0.2
8.10.0~dfsg-2ubuntu0.3
8.10.0~dfsg-2ubuntu0.4
8.10.0~dfsg-2ubuntu0.4+esm1
8.10.0~dfsg-2ubuntu0.4+esm2
8.10.0~dfsg-2ubuntu0.4+esm3
8.10.0~dfsg-2ubuntu0.4+esm4
8.10.0~dfsg-2ubuntu0.4+esm5

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / nodejs

Package

Name
nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

10.*

10.15.2~dfsg-2ubuntu1
10.17.0~dfsg-2ubuntu4
10.17.0~dfsg-2ubuntu6
10.19.0~dfsg-3ubuntu1
10.19.0~dfsg-3ubuntu1.1
10.19.0~dfsg-3ubuntu1.2
10.19.0~dfsg-3ubuntu1.3
10.19.0~dfsg-3ubuntu1.5
10.19.0~dfsg-3ubuntu1.6

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:22.04:LTS / nodejs

Package

Name
nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

12.*

12.22.5~dfsg-5ubuntu1
12.22.7~dfsg-2ubuntu1
12.22.7~dfsg-2ubuntu3
12.22.9~dfsg-1ubuntu2
12.22.9~dfsg-1ubuntu3
12.22.9~dfsg-1ubuntu3.1
12.22.9~dfsg-1ubuntu3.2
12.22.9~dfsg-1ubuntu3.3
12.22.9~dfsg-1ubuntu3.4
12.22.9~dfsg-1ubuntu3.5
12.22.9~dfsg-1ubuntu3.6

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / nodejs

Package

Name
nodejs

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2
18.19.1+dfsg-2ubuntu4
18.19.1+dfsg-6ubuntu1
18.19.1+dfsg-6ubuntu2
18.19.1+dfsg-6ubuntu5

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}