Permissions, Privileges, and Access Controls in Node.js - CVE-2023-30586

Vulnerability identifier: #VU77603

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30586

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to application allows loading arbitrary OpenSSL engines when the experimental permission model is enabled. A remote user can use the crypto.setEngine() API to bypass the permission model when called with a compatible OpenSSL engine and disable the permission model in the host process by manipulating the process's stack memory to locate the permission model Permission::enabled_ in the host process's heap memory.

Node.js
IBM Business Automation Workflow
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Spectrum Control
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Gentoo Linux
Oracle Solaris
Anolis OS
Voice Gateway
noslate-anode-npm
v8-devel
noslate-anode
noslate-anode-devel
noslate-anode-libs
noslate-anode-docs
noslate-anode-full-i18n
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

Install updates from vendor's website.

Node.js - update to 20.3.1
Voice Gateway - addressed in versions 1.0.8.6, 1.0.8.10
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.3
IBM Spectrum Control - update to 5.4.10.2
noslate-anode-npm - update to 9.6.7-1.18.17.1.1
v8-devel - update to 10.2.154.26-1.18.17.1.1
noslate-anode - update to 18.17.1-1
noslate-anode-devel - update to 18.17.1-1
noslate-anode-libs - update to 18.17.1-1
noslate-anode-docs - update to 18.17.1-1
noslate-anode-full-i18n - update to 18.17.1-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 2022.2.1-11
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2022.2.1-12, 2023.2.1-1

• https://nodejs.org/en/blog/vulnerability/june-2023-security-releases

• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Control
• Gentoo update for Node.js
• Anolis OS update for noslate-anode