Vulnerability Description
When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could force interruptions of application processing, as the process terminates when accessing public key info of provided certificates from user code. The current context of the users will be gone, and that will cause a DoS scenario. This vulnerability affects all active Node.js versions v16, v18, and, v20.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | >= 16.0.0, < 16.20.1 |
References
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releasesVendor Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://nodejs.org/en/blog/vulnerability/june-2023-security-releasesVendor Advisory
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20241101-0011/
FAQ
What is CVE-2023-30588?
CVE-2023-30588 is a vulnerability with a CVSS score of 5.3 (MEDIUM). When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs making it susceptible to DoS attacks when the attacker could for...
How severe is CVE-2023-30588?
CVE-2023-30588 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-30588?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Node.Js.