The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4013 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4013-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     January 11, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : node-mocha     Version        : 8.2.1+ds1+~cs29.4.27-3+deb11u1     CVE ID         : CVE-2021-23566 CVE-2024-55565     Debian Bug     :

    mocha a javascript test framework was affected by two     vulnerabilities in nanoid component.


    CVE-2021-23566

        nanoid package is vulnerable to Information Exposure via the         valueOf() function which allows to reproduce the last id generated.


    CVE-2024-55565

        nanoid package mishandles non-integer values of size parameter.

    For Debian 11 bullseye, these problems have been fixed in version     8.2.1+ds1+~cs29.4.27-3+deb11u1.

    We recommend that you upgrade your node-mocha packages.

    For the detailed security status of node-mocha please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-mocha

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4003 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4003-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 26, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : node-postcss     Version        : 8.2.1+~cs5.3.23-8+deb11u1     CVE ID         : CVE-2021-23566 CVE-2023-44270 CVE-2024-55565     Debian Bug     : 1053282

    Multiple vulnerabilities were fixed in node-postcss a     tool for transforming styles with JS plugins.

    CVE-2021-23566

        nanoid package is vulnerable to Information Exposure via the         valueOf() function which allows to reproduce the last id generated.

    CVE-2023-44270

        The vulnerability affects linters using PostCSS to parse external         untrusted CSS. An attacker can prepare CSS in such a way that it will         contains parts parsed by PostCSS as a CSS comment. After processing         by PostCSS, it will be included in the PostCSS output in CSS nodes         (rules, properties) despite being included in a comment.

    CVE-2024-55565

        nanoid package mishandles non-integer values of size parameter.

    For Debian 11 bullseye, these problems have been fixed in version     8.2.1+~cs5.3.23-8+deb11u1.

    We recommend that you upgrade your node-postcss packages.

    For the detailed security status of node-postcss please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-postcss

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213988	Debian dla-4013 : mocha - security update	Nessus	Debian Local Security Checks	medium
213394	Debian dla-4003 : node-postcss - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2021-23566

medium

Tenable Plugins

medium

medium