Bug 1212578 (CVE-2023-30583)

Summary: VUL-0: CVE-2023-30583: nodejs20: fs.openAsBlob bypass in experimental permission model
Product: [Novell Products] SUSE Security Incidents Reporter: Robert Frohl <rfrohl>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium    
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/370080/
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Robert Frohl 2023-06-21 11:47:43 UTC 
fs.openAsBlob bypass in experimental permission model (Medium) (CVE-2023-30583)

fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20. This flaw arises from a missing check in the fs.openAsBlob() API.

This vulnerability affects all users using the experimental permission model in Node.js 20.

Thanks to Colin Ihrig for reporting this vulnerability and to Rafael Gonzaga for fixing it.

Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
Comment 1 OBSbugzilla Bot 2023-06-21 12:45:12 UTC 
This is an autogenerated message for OBS integration:
This bug (1212578) was mentioned in
https://build.opensuse.org/request/show/1094364 Factory / nodejs20
Comment 5 Carlos López 2024-05-30 18:52:38 UTC 
Done, closing.