crítica
CVE-2023-32002
nodejs: Permissions policies can be bypassed via Module._load
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami, CBL-Mariner, Photon OS. Más baja según Red Hat (alta), AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 16.20.2, 18.17.1, 20.5.1 |
| CBL-Mariner 2.0 | nodejs, nodejs18 | 0:16.20.2-2.cm2 y 1 más |
| Photon OS 3.0 | nodejs | 16.20.2-1.ph3 |
| Photon OS 4.0 | nodejs, nodejs-devel | 18.20.8-1.ph4 |
| Photon OS 5.0 | nodejs, nodejs-devel | 18.17.1-1.ph5 |
| alma 8 | nodejs:16::nodejs, nodejs:16::nodejs-devel, nodejs:16::nodejs-docs y 12 más | 1:16.20.2-2.module_el8.8.0+3614+204d6f43 y 7 más |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n y 10 más | 1:16.20.2-1.el9_2 y 5 más |
| alpine 3.15 | nodejs | 16.20.2-r0 |
| alpine 3.16 | nodejs | 16.20.2-r0 |
| alpine 3.17 | nodejs | 18.17.1-r0 |
| alpine 3.18 | nodejs | 18.17.1-r0 |
| alpine 3.19 | nodejs | 18.17.1-r0 |
Mostrar las 123 entradas de 41 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 16.20.2, 18.17.1, 20.5.1 |
| bitnami::Bitnami Vulnerability Database | node-min | 16.20.2, 18.17.1, 20.5.1 |
| CBL-Mariner 2.0 | nodejs | 0:16.20.2-2.cm2 |
| CBL-Mariner 2.0 | nodejs18 | 0:18.17.1-2.cm2 |
| Photon OS 3.0 | nodejs | 16.20.2-1.ph3 |
| Photon OS 4.0 | nodejs | 18.20.8-1.ph4 |
| Photon OS 4.0 | nodejs-devel | 18.20.8-1.ph4 |
| Photon OS 5.0 | nodejs | 18.17.1-1.ph5 |
| Photon OS 5.0 | nodejs-devel | 18.17.1-1.ph5 |
| alma 8 | nodejs:16::nodejs | 1:16.20.2-2.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:16::nodejs-devel | 1:16.20.2-2.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:16::nodejs-docs | 1:16.20.2-2.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.20.2-2.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:16::nodejs-nodemon | 3.0.1-1.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:16::nodejs-packaging | 26-1.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:16::npm | 1:8.19.4-1.16.20.2.2.module_el8.8.0+3614+204d6f43 |
| alma 8 | nodejs:18::nodejs | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d |
| alma 8 | nodejs:18::nodejs-devel | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d |
| alma 8 | nodejs:18::nodejs-docs | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d |
| alma 8 | nodejs:18::nodejs-full-i18n | 1:18.17.1-1.module_el8.8.0+3613+1ed8c91d |
| alma 8 | nodejs:18::nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d |
| alma 8 | nodejs:18::nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| alma 8 | nodejs:18::nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 |
| alma 8 | nodejs:18::npm | 1:9.6.7-1.18.17.1.1.module_el8.8.0+3613+1ed8c91d |
| alma 9 | nodejs | 1:16.20.2-1.el9_2 |
| alma 9 | nodejs-docs | 1:16.20.2-1.el9_2 |
| alma 9 | nodejs-full-i18n | 1:16.20.2-1.el9_2 |
| alma 9 | nodejs-libs | 1:16.20.2-1.el9_2 |
| alma 9 | nodejs:18::nodejs | 1:18.17.1-1.module_el9.2.0+36+853e48f5 |
| alma 9 | nodejs:18::nodejs-devel | 1:18.17.1-1.module_el9.2.0+36+853e48f5 |
| alma 9 | nodejs:18::nodejs-docs | 1:18.17.1-1.module_el9.2.0+36+853e48f5 |
| alma 9 | nodejs:18::nodejs-full-i18n | 1:18.17.1-1.module_el9.2.0+36+853e48f5 |
| alma 9 | nodejs:18::nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 |
| alma 9 | nodejs:18::nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea |
| alma 9 | nodejs:18::nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea |
| alma 9 | nodejs:18::npm | 1:9.6.7-1.18.17.1.1.module_el9.2.0+36+853e48f5 |
| alma 9 | npm | 1:8.19.4-1.16.20.2.1.el9_2 |
| alpine 3.15 | nodejs | 16.20.2-r0 |
| alpine 3.16 | nodejs | 16.20.2-r0 |
| alpine 3.17 | nodejs | 18.17.1-r0 |
| alpine 3.18 | nodejs | 18.17.1-r0 |
| alpine 3.19 | nodejs | 18.17.1-r0 |
| alpine 3.20 | nodejs | 18.17.1-r0 |
| alpine 3.21 | nodejs | 18.17.1-r0 |
| alpine 3.22 | nodejs | 18.17.1-r0 |
| alpine 3.23 | nodejs | 18.17.1-r0 |
| alpine 3.24 | nodejs | 18.17.1-r0 |
| alpine edge | nodejs | 18.17.1-r0 |
| amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-debuginfo | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-debugsource | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-devel | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-docs | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-full-i18n | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-libs | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | nodejs-libs-debuginfo | 1:18.12.1-1.amzn2023.0.10 |
| amazon linux 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.10 |
| amazon linux 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.10 |
| chainguard | nodejs-16 | 16.20.2-r0 |
| chainguard | nodejs-18 | 18.17.1-r0 |
| chainguard | nodejs-20 | 20.5.1-r0 |
| debian 11 | nodejs | sin corrección indicada |
| debian 12 | nodejs | 18.19.0+dfsg-6~deb12u1 |
| debian 13 | nodejs | 18.13.0+dfsg1-1.1 |
| debian 14 | nodejs | 18.13.0+dfsg1-1.1 |
| echo | nodejs | 18.19.0+dfsg-6~deb12u1 |
| Oracle Linux 8 | nodejs | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 |
| Oracle Linux 8 | nodejs-devel | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 |
| Oracle Linux 8 | nodejs-docs | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 |
| Oracle Linux 8 | nodejs-full-i18n | 1:18.17.1-1.module+el8.8.0+21170+2efec6d4 |
| Oracle Linux 8 | nodejs-nodemon | 3.0.1-1.module+el8.8.0+21172+0baa0bae |
| Oracle Linux 8 | nodejs-packaging | 2021.06-4.module+el8.7.0+20766+0a247725 |
| Oracle Linux 8 | nodejs-packaging-bundler | 2021.06-4.module+el8.7.0+20766+0a247725 |
| Oracle Linux 8 | npm | 1:9.6.7-1.18.17.1.1.module+el8.8.0+21170+2efec6d4 |
| Oracle Linux 9 | nodejs | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux 9 | nodejs-devel | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux 9 | nodejs-docs | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux 9 | nodejs-full-i18n | 1:18.17.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux 9 | nodejs-libs | 1:16.20.2-1.el9_2 |
| Oracle Linux 9 | nodejs-nodemon | 3.0.1-1.module+el9.2.0+21169+1d24b6cc |
| Oracle Linux 9 | nodejs-packaging | 2021.06-4.module+el9.1.0+20762+f52d7401 |
| Oracle Linux 9 | nodejs-packaging-bundler | 2021.06-4.module+el9.1.0+20762+f52d7401 |
| Oracle Linux 9 | npm | 1:9.6.7-1.18.17.1.1.module+el9.2.0+21169+1d24b6cc |
| rapidfort alma 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0, 3.0.1-1.module_el9.2.0+36+853e48f5 |
| rapidfort amazon linux 2023 | nodejs | 1:18.12.1-1.amzn2023.0.10 |
| rapidfort amazon linux 2023 | nodejs-devel | 1:18.12.1-1.amzn2023.0.10 |
| rapidfort amazon linux 2023 | nodejs-docs | 1:18.12.1-1.amzn2023.0.10 |
| rapidfort amazon linux 2023 | nodejs-full-i18n | 1:18.12.1-1.amzn2023.0.10 |
| rapidfort amazon linux 2023 | nodejs-libs | 1:18.12.1-1.amzn2023.0.10 |
| rapidfort amazon linux 2023 | npm | 1:8.19.2-1.18.12.1.1.amzn2023.0.10 |
| rapidfort amazon linux 2023 | v8-devel | 2:10.2.154.15-1.18.12.1.1.amzn2023.0.10 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.20.2-1.el9_2 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.20.2-1.el9_2 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.20.2-1.el9_2 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.20.2-1.el9_2 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 |
| rapidfort Oracle Linux 9 | npm | 1:8.19.4-1.16.20.2.1.el9_2 |
| rapidfort Red Hat 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.2.0.z+19753+58118bc0 |
| rapidfort rocky 9 | nodejs | 1:16.20.2-1.el9_2 |
| rapidfort rocky 9 | nodejs-nodemon | 0:3.0.1-1.module+el9.7.0+40017+f0db1785 |
| rapidfort ubuntu 20.04 | nodejs | 0:12.22.9~dfsg-1ubuntu3.6 |
| rapidfort ubuntu 20.04 | rf-nodejs | 0:12.22.9~dfsg-1ubuntu3.6 |
| rapidfort ubuntu 22.04 | nodejs | 0:12.22.9~dfsg-1ubuntu3.6 |
| rapidfort ubuntu 22.04 | rf-nodejs | 0:12.22.9~dfsg-1ubuntu3.6 |
| rapidfort ubuntu 24.04 | nodejs | 0:12.22.9~dfsg-1ubuntu3.6 |
| rapidfort ubuntu 24.04 | rf-nodejs | 0:12.22.9~dfsg-1ubuntu3.6 |
| rocky 8 | nodejs:16::nodejs-nodemon | 3.0.1-1.module+el8.10.0+1924+614dc87f |
| rocky 8 | nodejs:16::nodejs-packaging | 2021.06-4.module+el8.9.0+1419+1f26ef47 |
| rocky 8 | nodejs:16::nodejs-packaging-bundler | 2021.06-4.module+el8.10.0+1924+614dc87f |
| rocky 9 | nodejs | 0.0.0 |
| rocky 9 | nodejs-docs | 1:16.20.2-1.el9_2 |
| rocky 9 | nodejs-full-i18n | 0.0.0 |
| rocky 9 | nodejs-libs | 0.0.0 |
| rocky 9 | nodejs:20::nodejs-nodemon | 3.0.1-1.module+el9.7.0+40018+a011993d |
| rocky 9 | nodejs:20::nodejs-packaging | 2021.06-4.module+el9.7.0+40025+0e0cf6b2 |
| rocky 9 | nodejs:20::nodejs-packaging-bundler | 2021.06-4.module+el9.7.0+40018+a011993d |
| rocky 9 | npm | 0.0.0 |
| root.io debian 12 | rootio-nodejs | 18.19.0+dfsg-6~deb12u1 |
| ubuntu 22.04 | nodejs | 12.22.9~dfsg-1ubuntu3.6 |
| ubuntu 23.10 | nodejs | 18.13.0+dfsg1-1ubuntu2.3 |
| wolfi | nodejs-16 | 16.20.2-r0 |
| wolfi | nodejs-18 | 18.17.1-r0 |
| wolfi | nodejs-20 | 20.5.1-r0 |
Referencias
- https://access.redhat.com/errata/RHSA-2023:5363
- https://access.redhat.com/errata/RHSA-2023:5532
- https://access.redhat.com/security/cve/CVE-2023-32002
- https://bugzilla.redhat.com/2230948
- https://bugzilla.redhat.com/2230955
- https://bugzilla.redhat.com/2230956
- https://bugzilla.redhat.com/show_bug.cgi?id=2216475
- https://bugzilla.redhat.com/show_bug.cgi?id=2230948
Las 27 referencias
- https://bugzilla.redhat.com/show_bug.cgi?id=2230955
- https://bugzilla.redhat.com/show_bug.cgi?id=2230956
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25883
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32002
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32006
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32559
- https://errata.almalinux.org/9/ALSA-2023-5532.html
- https://errata.rockylinux.org/RLSA-2023:5363
- https://github.com/nodejs/node/commit/15bced0bde93f24115b779a309d517845c87e17a%20%28v18.x%29
- https://github.com/nodejs/node/commit/b68e5e798138be0041ba9ace72d8d45e63c068a1%20%28main%29
- https://hackerone.com/reports/1960870
- https://linux.oracle.com/cve/CVE-2023-32002.html
- https://linux.oracle.com/errata/ELSA-2023-5532.html
- https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002
- https://nvd.nist.gov/vuln/detail/CVE-2023-32002
- https://security.netapp.com/advisory/ntap-20230915-0009/
- https://ubuntu.com/security/notices/USN-6822-1
- https://www.cve.org/CVERecord?id=CVE-2023-32002