Fedora38:nodejs16 (2023-608a1417d3)

高位奈苏斯插件ID 178702

语言 :

简表

远程Fedora主机缺一个或多个安全更新

描述性

FEDORA-2023-608a1417d3咨询中引用的远程Fedora38主机安装包受多重漏洞影响

LUT解析器Nordev20.0模块不严格使用CRLF序列限定HTTP请求可能导致HTTP请求走私CR字符(无LF)足以限定llth解析器中HTTP页眉字段RFC7230第3节显示,只有CRLF序列应划分页眉字段影响所有Norde.js活动版本:v16,v18和v20(CVE2023-30589)

#2023-06-20版本16.20.1Gallium### Notable Changes The following CVEs are fixed in this release: * [CVE-2023-30581](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2023-30581): `mainModule.__proto__` Bypass Experimental Policy Mechanism (High) * [CVE-2023-30585](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30585): Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium) * [CVE-2023-30588](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30588): Process interuption due to invalid Public Key information in x509 certificates (Medium) * [CVE-2023-30589](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30589): HTTP Request Smuggling via Empty headers separated by CR (Medium) * [CVE-2023-30590](https://cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2023-30590): DiffieHellman does not generate keys after setting a private key (Medium) * OpenSSL Security Releases * [OpenSSL security advisory 28th March](https://www.openssl.org/news/secadv/20230328.txt).ss/secadv/202304.tSSL安全咨询5月30日sss/GHSA-978-jv2r-p7vcss
(CVE-2023-30581, CVE-2023-30585, CVE-2023-30588, CVE-2023-30590)

注意Nessus没有测试这些问题,而是只依赖应用自报版号