Is CVE-2023-46809 in the CISA KEV catalog?

No. CVE-2023-46809 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2023-46809?

CVE-2023-46809 has a CVSS v3 base score of 7.4 (HIGH).

What is the EPSS score for CVE-2023-46809?

CVE-2023-46809 has an EPSS score of 1.30% (67th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2023-46809?

Upgrade nodejs on debian 11 to 12.22.12~dfsg-1~deb11u5 or later. Fixes are available for 21 affected products.

CVE & CISA-KEV Catalog

CVE-2023-46809

HIGH

7.4

CVSS v3

NVD

Description

Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are vulnerable to the Marvin Attack - https://people.redhat.com/~hkario/marvin/, if PCKS #1 v1.5 padding is allowed when performing RSA descryption using a private key.

CWE-385

How to fix

Remediation Available

nodejsDebian

Fixed in:12.22.12~dfsg-1~deb11u5CVE-2023-46809

Fixed in:18.20.4+dfsg-1~deb12u1CVE-2023-46809

Fixed in:18.19.1+dfsg-1CVE-2023-46809

nodejsRed Hat / RHEL

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.aarch64::nodejs:18RHSA-2024:1510

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.ppc64le::nodejs:18RHSA-2024:1932

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.s390x::nodejs:18RHSA-2024:1932

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.src::nodejs:20RHSA-2024:1687

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.s390x::nodejs:20RHSA-2024:1687

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.ppc64le::nodejs:20RHSA-2024:1688

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.ppc64le::nodejs:20RHSA-2024:1687

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.x86_64::nodejs:18RHSA-2024:1880

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.aarch64::nodejs:20RHSA-2024:1688

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.aarch64::nodejs:18RHSA-2024:1880

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.x86_64::nodejs:20RHSA-2024:1687

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.src::nodejs:18RHSA-2024:1503

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.src::nodejs:18RHSA-2024:1880

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.src::nodejs:20RHSA-2024:1688

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.x86_64::nodejs:18RHSA-2024:1510

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.aarch64::nodejs:18RHSA-2024:1503

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.x86_64::nodejs:20RHSA-2024:1688

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.ppc64le::nodejs:18RHSA-2024:1503

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.s390x::nodejs:18RHSA-2024:1503

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.s390x::nodejs:18RHSA-2024:1510

Fixed in:1:18.19.1-1.module+el9.3.0+21388+22892fb9.x86_64::nodejs:18RHSA-2024:1503

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.ppc64le::nodejs:18RHSA-2024:1510

Fixed in:1:20.11.1-1.module+el8.9.0+21380+12032667.aarch64::nodejs:20RHSA-2024:1687

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.ppc64le::nodejs:18RHSA-2024:1880

Fixed in:1:18.19.1-1.module+el8.9.0+21387+21356dec.src::nodejs:18RHSA-2024:1510

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.src::nodejs:18RHSA-2024:1932

Fixed in:1:20.11.1-1.module+el9.3.0+21385+bac43d5a.s390x::nodejs:20RHSA-2024:1688

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.x86_64::nodejs:18RHSA-2024:1932

Fixed in:1:18.19.1-1.module+el9.2.0+21594+a052107e.aarch64::nodejs:18RHSA-2024:1932

Fixed in:1:18.19.1-1.module+el8.8.0+21592+14a8b93e.s390x::nodejs:18RHSA-2024:1880

nodejsRocky