{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Node.js ist eine Plattform zur Entwicklung von Netzwerkanwendungen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein  Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Informationen offenzulegen oder Dateien zu manipulieren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-1533 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-1533.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-1533 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1533"
      },
      {
        "category": "external",
        "summary": "NodeJS Release Notes vom 2022-09-25",
        "url": "https://nodejs.org/en/blog/release/v18.9.1/"
      },
      {
        "category": "external",
        "summary": "NodeJS Release Notes vom 2022-09-25",
        "url": "https://nodejs.org/en/blog/release/v16.17.1/"
      },
      {
        "category": "external",
        "summary": "NodeJS Release Notes vom 2022-09-25",
        "url": "https://nodejs.org/en/blog/release/v14.20.1/"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3503-1 vom 2022-10-04",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012487.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3516-1 vom 2022-10-04",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012493.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3524-1 vom 2022-10-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012497.html"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2022-D84D27C5AD vom 2022-10-06",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2022-d84d27c5ad"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6964 vom 2022-10-17",
        "url": "https://access.redhat.com/errata/RHSA-2022:6964"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-6963 vom 2022-10-17",
        "url": "https://linux.oracle.com/errata/ELSA-2022-6963.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-6964 vom 2022-10-18",
        "url": "http://linux.oracle.com/errata/ELSA-2022-6964.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3614-1 vom 2022-10-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012558.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3615-1 vom 2022-10-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012560.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3616-1 vom 2022-10-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012563.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6963 vom 2022-10-18",
        "url": "https://access.redhat.com/errata/RHSA-2022:6963"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7044 vom 2022-10-19",
        "url": "https://access.redhat.com/errata/RHSA-2022:7044"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3656-1 vom 2022-10-19",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012579.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3835-1 vom 2022-11-01",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-November/012781.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6833888 vom 2022-11-03",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-in-ibm-sdk-for-node-js-might-affect-the-configuration-editor-used-by-ibm-business-automation-workflow/"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7830 vom 2022-11-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:7830"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7821 vom 2022-11-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:7821"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-7821 vom 2022-11-15",
        "url": "https://linux.oracle.com/errata/ELSA-2022-7821.html"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-8833 vom 2022-12-08",
        "url": "http://linux.oracle.com/errata/ELSA-2022-8833.html"
      },
      {
        "category": "external",
        "summary": "PoC auf huntr.dev vom 2022-12-08",
        "url": "https://hackerone.com/reports/1675191"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6848587 vom 2022-12-22",
        "url": "https://www.ibm.com/support/pages/node/6848587"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6849223 vom 2023-01-06",
        "url": "https://www.ibm.com/support/pages/node/6849223"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-0321 vom 2023-01-24",
        "url": "https://linux.oracle.com/errata/ELSA-2023-0321.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0321 vom 2023-01-23",
        "url": "https://access.redhat.com/errata/RHSA-2023:0321"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-5326 vom 2023-01-24",
        "url": "https://lists.debian.org/debian-security-announce/2023/msg00015.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0408-1 vom 2023-02-14",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013759.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2023:0419-1 vom 2023-02-15",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-February/013766.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1533 vom 2023-04-01",
        "url": "https://access.redhat.com/errata/RHSA-2023:1533"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1742 vom 2023-04-12",
        "url": "https://access.redhat.com/errata/RHSA-2023:1742"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2023-3586 vom 2023-06-15",
        "url": "https://linux.oracle.com/errata/ELSA-2023-3586.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7005589 vom 2023-06-21",
        "url": "https://www.ibm.com/support/pages/node/7005589"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7005925 vom 2023-06-21",
        "url": "https://www.ibm.com/support/pages/node/7005925"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-286 vom 2024-01-23",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2023-286.html"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-6491-1 vom 2023-11-21",
        "url": "https://ubuntu.com/security/notices/USN-6491-1"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202405-29 vom 2024-05-08",
        "url": "https://security.gentoo.org/glsa/202405-29"
      }
    ],
    "source_lang": "en-US",
    "title": "Node.js: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-05-09T22:00:00.000+00:00",
      "generator": {
        "date": "2024-05-10T09:04:14.093+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-1533",
      "initial_release_date": "2022-09-25T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-09-25T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-09-28T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: FEDORA-2022-58055CB1EF, FEDORA-2022-3793987B02, 2130518, 2130517, FEDORA-2022-B7766DDF3E"
        },
        {
          "date": "2022-10-04T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-10-05T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-10-06T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2022-10-17T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2022-10-18T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Oracle Linux, SUSE und Red Hat aufgenommen"
        },
        {
          "date": "2022-10-19T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat und SUSE aufgenommen"
        },
        {
          "date": "2022-11-01T23:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-11-02T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2022-11-07T23:00:00.000+00:00",
          "number": "11",
          "summary": "Referenz(en) aufgenommen: FEDORA-2022-DE515F765F, FEDORA-2022-52DEC6351A, FEDORA-2022-1667F7B60A"
        },
        {
          "date": "2022-11-08T23:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-15T23:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-12-07T23:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-12-08T23:00:00.000+00:00",
          "number": "15",
          "summary": "PoC aufgenommen"
        },
        {
          "date": "2022-12-21T23:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-01-08T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von IBM und IBM-APAR aufgenommen"
        },
        {
          "date": "2023-01-23T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
        },
        {
          "date": "2023-01-24T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2023-02-14T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-02-15T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2023-04-02T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-04-12T22:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-06-14T22:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2023-06-20T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-06-21T22:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-11-20T23:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2024-01-22T23:00:00.000+00:00",
          "number": "28",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-05-09T22:00:00.000+00:00",
          "number": "29",
          "summary": "Neue Updates von Gentoo aufgenommen"
        }
      ],
      "status": "final",
      "version": "29"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM Business Automation Workflow",
            "product": {
              "name": "IBM Business Automation Workflow",
              "product_id": "T019704",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:business_automation_workflow:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "10.5.0",
                "product": {
                  "name": "IBM DataPower Gateway 10.5.0",
                  "product_id": "T025693",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.5.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "10.0.1",
                "product": {
                  "name": "IBM DataPower Gateway 10.0.1",
                  "product_id": "T025694",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:10.0.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "V10CD",
                "product": {
                  "name": "IBM DataPower Gateway V10CD",
                  "product_id": "T025695",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:datapower_gateway:v10cd"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DataPower Gateway"
          },
          {
            "category": "product_name",
            "name": "IBM Integration Bus",
            "product": {
              "name": "IBM Integration Bus",
              "product_id": "T011169",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:integration_bus:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Plus 10.1",
                "product": {
                  "name": "IBM Spectrum Protect Plus 10.1",
                  "product_id": "T015895",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spectrum_protect:plus_10.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spectrum Protect"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cv16.17.1",
                "product": {
                  "name": "Open Source Node.js \u003cv16.17.1",
                  "product_id": "T024692",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nodejs:nodejs:v16.17.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cv14.20.1",
                "product": {
                  "name": "Open Source Node.js \u003cv14.20.1",
                  "product_id": "T024693",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nodejs:nodejs:v14.20.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cv18.9.1",
                "product": {
                  "name": "Open Source Node.js \u003cv18.9.1",
                  "product_id": "T024694",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nodejs:nodejs:v18.9.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Node.js"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-35255",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Node.js. Der Fehler besteht in der Funktion \"WebCrypto keygen\" und ist auf einen unzureichenden Zufall beim Erzeugen von Schl\u00fcsseln zur\u00fcckzuf\u00fchren. Ein Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "67646",
          "T011169",
          "T012167",
          "T015895",
          "T004914",
          "2951",
          "T002207",
          "T000126",
          "T019704",
          "398363",
          "T025693",
          "T025695",
          "T025694"
        ]
      },
      "release_date": "2022-09-25T22:00:00Z",
      "title": "CVE-2022-35255"
    },
    {
      "cve": "CVE-2022-35256",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Node.js. Es besteht die M\u00f6glichkeit zum HTTP-Request-Smuggling, da \"Header\"-Felder inkorrekt geparst werden. Ein Angreifer kann diese Schwachstelle ausnutzen, um Dateien zu manipulieren."
        }
      ],
      "product_status": {
        "known_affected": [
          "67646",
          "T011169",
          "T012167",
          "T015895",
          "T004914",
          "2951",
          "T002207",
          "T000126",
          "T019704",
          "398363",
          "T025693",
          "T025695",
          "T025694"
        ]
      },
      "release_date": "2022-09-25T22:00:00Z",
      "title": "CVE-2022-35256"
    }
  ]
}