Overview
Node is a JavaScript runtime built on Chrome's V8 JavaScript engine. It offers a rich library of various JavaScript modules and is widely used in server-side applications.
An Cryptographic Issues - Generic (CWE-310) vulnerability has been identified in Node. The issue stems from a cryptographic vulnerability that does not clear the OpenSSL error stack after operations that may set it. This weakness may allow attackers to cause a denial of service.
This vulnerability affects specific versions of the package and can result in denial of service. Details on affected versions and reproduction steps are provided below.
Details
Module Info
Affected packages: Node
Affected versions: 4.0 < 14.21.3, 16 < 16.19.1, 18 < 18.14.1
GitHub repository: https://github.com/nodejs/node
Published packages: https://github.com/nodejs/node/releases
Package manager: npm
Fixed in: Node.js NES version 12
Vulnerability Info
The issue stems from a failure to clear the OpenSSL error stack after operations that may set it.
For instance, in a multi-threaded environment, if a cryptographic operation fails, the system may not handle subsequent operations correctly. This behavior can be exploited by attackers to cause a denial of service.
This vulnerability is a result of flawed logic, and may allow attackers to cause a denial of service.
Credits
- Morgan Jones
Mitigation
This vulnerability is not fixed upstream due to the release line being EOL. Herodevs has issued patched builds under the NES (Never Ending Support) line.
- Update to a patched LTS version of Node.js
- Leverage a commercial support partner like HeroDevs for post-EOL security
