Detections
Analytics
Alpine: nodejs: security update to 18.17.1-r0
critical Tenable Cloud Security Plugin ID 405822
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json
definition for a given module. This vulnerability affects all users using the experimental policy
mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was
issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)
- The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules
outside of the policy.json definition for a given module. This vulnerability affects all users using the
experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the
time this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32006)
- A privilege escalation vulnerability exists in the experimental policy mechanism in all active release
lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy
mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')`
run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time
this CVE was issued, the policy is an experimental feature of Node.js. (CVE-2023-32559)
See Also
https://security.alpinelinux.org/vuln/CVE-2023-32002
Plugin Details
Severity: Critical
ID: 405822
Version: Revision 1.32
Type: Local
Published: 10/31/2023
Updated: 11/19/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-32002
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 8/10/2023