CVE-2023-23919: High severity ibm cognos controller vulnerability
A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
Other sources
In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.
— Red Hat
Node.js is vulnerable to a denial of service, caused by not clear the OpenSSL error stack after operations. By sending specially-crafted cryptographic operations, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-23919?
CVE-2023-23919 is a cryptographic vulnerability in Node.js versions <19.2.0, <18.14.1, <16.19.1, <14.21.3 that may lead to false positive errors during subsequent cryptographic operations.
How does CVE-2023-23919 affect Node.js?
CVE-2023-23919 affects Node.js versions <19.2.0, <18.14.1, <16.19.1, <14.21.3.
What is the severity of CVE-2023-23919?
CVE-2023-23919 has a severity rating of 7.5 (high).
Which versions of Node.js are affected by CVE-2023-23919?
Node.js versions <19.2.0, <18.14.1, <16.19.1, and <14.21.3 are affected by CVE-2023-23919.
How can I fix CVE-2023-23919?
To fix CVE-2023-23919, update Node.js to version 19.2.0 or later, version 18.14.1 or later, version 16.19.1 or later, or version 14.21.3 or later.