Ubuntu Security Updates Addressed Node.js Vulnerabilities

Rohan Timalsina

January 16, 2024 - TuxCare expert team

The Ubuntu security team has recently addressed several vulnerabilities affecting Node.js packages in Ubuntu 22.04 LTS. These vulnerabilities were initially found in OpenSSL. As the Node.js uses OpenSSL, it affected node.js packages in Ubuntu 22.04.LTS “Jammy Jellyfish”. However, Ubuntu has mentioned that other Ubuntu versions are not vulnerable in the CVE status. Staying informed about potential vulnerabilities and promptly addressing them is crucial to ensure a secure and resilient environment.

In this article, we will delve into the details of these vulnerabilities and their potential impact on the Ubuntu 22.04 LTS systems.

Node.js Vulnerabilities Fixed in Ubuntu 22.04 LTS

CVE-2022-4304 (Cvss 3 Severity Score: 5.9 Medium)

Hubert Kario’s discovers a vulnerability, where certain inputs were mishandled. If an unsuspecting user or automated system opens a specially crafted input file, a remote attacker might exploit this flaw to obtain sensitive information. This underscores the importance of promptly addressing such vulnerabilities to safeguard confidential data.

CVE-2022-4450 (Cvss 3 Severity Score: 7.5 High)

CarpetFuzz and Dawei Wang uncovered a Node.js vulnerability in the handling of specific inputs. In this scenario, opening a specially crafted input file could potentially allow a remote attacker to orchestrate a denial of service attack. It is crucial to recognize the severity of such issues and take proactive measures to mitigate potential disruptions.

CVE-2023-0215 (Cvss 3 Severity Score: 7.5 High)

Octavio Galland and Marcel Böhme’s discovery highlighted another vulnerability in Node.js. Similar to the previous case, the incorrect handling of specific inputs could lead to a denial of service situation.

CVE-2023-0286 (Cvss 3 Severity Score: 7.4 High)

David Benjamin identified a vulnerability that mishandled certain inputs, potentially leading to the exposure of sensitive information. This emphasizes the importance of maintaining an up-to-date Node.js environment to mitigate the risk of unauthorized access to critical data.

CVE-2023-0401 (Cvss 3 Severity Score: 7.5 High)

Hubert Kario and Dmitry Belyavsky discovered a vulnerability in Node.js that, when exploited, could cause a denial of service through the manipulation of certain inputs. Ensuring the security of your Node.js installation is paramount to prevent potential disruptions to your applications and services.

Conclusion: Patching the Vulnerabilities

Users should be vigilant about updating their systems promptly to prevent potential exploitation of this vulnerability. To address these vulnerabilities, you should update your Node.js packages to the latest version in Ubuntu 22.04. After performing the system update, a reboot will be required to implement the changes.

If you want to avoid rebooting, you can consider using TuxCare’s KernelCare Enterprise for applying security patches to Ubuntu systems. KernelCare is an automated live patching solution which means it will automatically deploy all security updates without having to reboot the system.

For more details, learn about live patching and how live patching works with KernelCare Enterprise.

The sources for this article can be found on USN-6564-1.

Summary