{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_nodejs/alpinelinux3.24/vex/2022/cve-2022-3602-els_alt_nodejs-alpinelinux3_24.json" } ], "tracking": { "current_release_date": "2026-07-31T12:47:10Z", "generator": { "date": "2026-07-31T12:47:10Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2022-3602-ELS_ALT_NODEJS-ALPINELINUX3.24", "initial_release_date": "2022-11-01T18:15:00Z", "revision_history": [ { "date": "2022-11-01T18:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-07-24T12:25:10Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-07-27T12:26:25Z", "number": "3", "summary": "Update document" }, { "date": "2026-07-29T08:27:03Z", "number": "4", "summary": "Update document" }, { "date": "2026-07-31T12:47:10Z", "number": "5", "summary": "Update document" } ], "status": "final", "version": "5" }, "title": "Security update on CVE-2022-3602" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Alpine Linux 3.24", "product": { "name": "Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24", "product_identification_helper": { "cpe": "cpe:2.3:o:alpinelinux:alpine_linux:3.24:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Alpine Linux" } ], "category": "vendor", "name": "Alpine Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-dev-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-dev-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-doc-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-doc-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r14.aarch64", "product": { "name": "alt-nodejs18-npm-18.20.8-r14.aarch64", "product_id": "alt-nodejs18-npm-18.20.8-r14.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r14?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-doc-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-doc-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-doc-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-doc@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-dev-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-dev-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-dev-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-dev@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-npm-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-npm-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-npm@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-14.21.3-r25.aarch64", "product": { "name": "alt-nodejs14-14.21.3-r25.aarch64", "product_id": "alt-nodejs14-14.21.3-r25.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14@14.21.3-r25?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-dev-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-dev-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-dev-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-dev@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-npm-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-npm-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-npm-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-npm@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-doc-16.20.2-r20.aarch64", "product": { "name": "alt-nodejs16-doc-16.20.2-r20.aarch64", "product_id": "alt-nodejs16-doc-16.20.2-r20.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-doc@16.20.2-r20?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-doc-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-doc-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-doc-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-doc@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-dev-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-dev-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-dev-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-dev@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-npm-23.11.1-r15.aarch64", "product": { "name": "alt-nodejs23-npm-23.11.1-r15.aarch64", "product_id": "alt-nodejs23-npm-23.11.1-r15.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-npm@23.11.1-r15?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-npm-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-npm-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-dev-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-dev-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-doc-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-doc-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r17.aarch64", "product": { "name": "alt-nodejs18-18.20.8-r17.aarch64", "product_id": "alt-nodejs18-18.20.8-r17.aarch64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r17?arch=aarch64&os_name=alpine&os_version=3.24" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-dev-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-dev-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-doc-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-doc-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r14.x86_64", "product": { "name": "alt-nodejs18-npm-18.20.8-r14.x86_64", "product_id": "alt-nodejs18-npm-18.20.8-r14.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r14?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-doc-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-doc-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-doc-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-doc@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-dev-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-dev-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-dev-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-dev@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-npm-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-npm-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-npm-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14-npm@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs14-14.21.3-r25.x86_64", "product": { "name": "alt-nodejs14-14.21.3-r25.x86_64", "product_id": "alt-nodejs14-14.21.3-r25.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs14@14.21.3-r25?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-dev-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-dev-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-dev-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-dev@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-npm-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-npm-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-npm-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-npm@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs16-doc-16.20.2-r20.x86_64", "product": { "name": "alt-nodejs16-doc-16.20.2-r20.x86_64", "product_id": "alt-nodejs16-doc-16.20.2-r20.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs16-doc@16.20.2-r20?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-doc-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-doc-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-doc-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-doc@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-dev-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-dev-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-dev-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-dev@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs23-npm-23.11.1-r15.x86_64", "product": { "name": "alt-nodejs23-npm-23.11.1-r15.x86_64", "product_id": "alt-nodejs23-npm-23.11.1-r15.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs23-npm@23.11.1-r15?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-npm-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-npm-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-npm-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-npm@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-dev-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-dev-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-dev-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-dev@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-doc-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-doc-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-doc-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18-doc@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } }, { "category": "product_version", "name": "alt-nodejs18-18.20.8-r17.x86_64", "product": { "name": "alt-nodejs18-18.20.8-r17.x86_64", "product_id": "alt-nodejs18-18.20.8-r17.x86_64", "product_identification_helper": { "purl": "pkg:apk/tuxcare/alt-nodejs18@18.20.8-r17?arch=x86_64&os_name=alpine&os_version=3.24" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r14.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r14.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r14.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r14.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-doc-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-doc-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-doc-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-doc-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-dev-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-dev-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-dev-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-dev-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-npm-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-npm-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-npm-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-14.21.3-r25.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64" }, "product_reference": "alt-nodejs14-14.21.3-r25.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs14-14.21.3-r25.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64" }, "product_reference": "alt-nodejs14-14.21.3-r25.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-dev-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-dev-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-dev-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-dev-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-npm-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-npm-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-npm-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-npm-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-doc-16.20.2-r20.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64" }, "product_reference": "alt-nodejs16-doc-16.20.2-r20.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs16-doc-16.20.2-r20.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64" }, "product_reference": "alt-nodejs16-doc-16.20.2-r20.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-doc-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-doc-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-doc-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-doc-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-dev-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-dev-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-dev-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-dev-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-npm-23.11.1-r15.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64" }, "product_reference": "alt-nodejs23-npm-23.11.1-r15.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs23-npm-23.11.1-r15.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" }, "product_reference": "alt-nodejs23-npm-23.11.1-r15.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-npm-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-npm-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-dev-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-dev-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-doc-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-doc-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r17.x86_64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64" }, "product_reference": "alt-nodejs18-18.20.8-r17.x86_64", "relates_to_product_reference": "Alpine-Linux-3.24" }, { "category": "default_component_of", "full_product_name": { "name": "alt-nodejs18-18.20.8-r17.aarch64 as a component of Alpine Linux 3.24", "product_id": "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64" }, "product_reference": "alt-nodejs18-18.20.8-r17.aarch64", "relates_to_product_reference": "Alpine-Linux-3.24" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-3602", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler. Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "fixed": [ "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" ], "known_not_affected": [ "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-lang/cve/CVE-2022-3602" }, { "category": "external", "summary": "http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html", "url": "http://packetstormsecurity.com/files/169687/OpenSSL-Security-Advisory-20221101.html" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/15", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/15" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/16", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/16" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/17", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/17" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/18", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/18" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/19", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/19" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/20", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/20" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/21", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/21" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/01/24", "url": "http://www.openwall.com/lists/oss-security/2022/11/01/24" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/1", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/10", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/10" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/11", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/11" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/12", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/12" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/13", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/13" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/14", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/14" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/15", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/15" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/2", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/2" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/3", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/3" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/5", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/5" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/6", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/6" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/7", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/7" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/02/9", "url": "http://www.openwall.com/lists/oss-security/2022/11/02/9" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/1", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/10", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/10" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/11", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/11" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/2", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/2" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/3", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/3" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/5", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/5" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/6", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/6" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/7", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/7" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2022/11/03/9", "url": "http://www.openwall.com/lists/oss-security/2022/11/03/9" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=fe3b639dc19b325846f4f6801f2f4604f56e3de3" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63YRPWPUSX3MBHNPIEJZDKQT6YA7UF6S/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWP23EZYOBDJQP7HP4YU7W2ABU2YDITS/" }, { "category": "external", "summary": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023", "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202211-01", "url": "https://security.gentoo.org/glsa/202211-01" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20221102-0001/", "url": "https://security.netapp.com/advisory/ntap-20221102-0001/" }, { "category": "external", "summary": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a", "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-W9sdCc2a" }, { "category": "external", "summary": "https://www.kb.cert.org/vuls/id/794340", "url": "https://www.kb.cert.org/vuls/id/794340" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20221101.txt", "url": "https://www.openssl.org/news/secadv/20221101.txt" }, { "category": "external", "summary": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00789.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-408105.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-408105.html" } ], "release_date": "2022-11-01T18:15:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-dev-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-doc-23.11.1-r15.x86_64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.aarch64", "Alpine-Linux-3.24:alt-nodejs23-npm-23.11.1-r15.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" }, { "category": "impact", "date": "2026-07-24T09:52:52.178087Z", "details": "important", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-dev-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-doc-18.20.8-r17.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r14.x86_64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.aarch64", "Alpine-Linux-3.24:alt-nodejs18-npm-18.20.8-r17.x86_64" ] }, { "category": "impact", "date": "2026-07-29T07:48:26.809099Z", "details": "Not vulnerable\n\nalt-nodejs14 14.21.3: NOT AFFECTED — vulnerable component absent: bundled OpenSSL is 1.1.1t, which has no `crypto/punycode.c` at all, and the Alpine build links shared alt-openssl11 (OpenSSL 1.1.1), a line OpenSSL states is not affected.\n\nPlatform in scope: alpinelinux3.24 (alt-nodejs14 14). Assessed against the shipped source and build configuration of alt-nodejs14, not NVD version ranges.\n\nEvidence\n**Which basis applies where.** For alt-nodejs14 and alt-nodejs16 the verdict rests on **absence of the vulnerable component** (not on absence of the fix). For alt-nodejs23 the component *is* present and the verdict rests on **presence of the fix**.\n\n**Upstream fix commit + first release**\n- `openssl/openssl@fe3b639dc19b325846f4f6801f2f4604f56e3de3` — \"Fix CVE-2022-3602 in punycode decoder.\" (Pauli, 2022-10-27), branch `openssl-3.0`. https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3\n- First upstream release containing it: **OpenSSL 3.0.7** (`git tag --contains fe3b639` → earliest is `openssl-3.0.7`).\n- The fix is one line in `crypto/punycode.c`, `ossl_punycode_decode()`: `if (written_out > max_out)` → `if (written_out >= max_out)`.\n- Companion commit in the same release: `openssl/openssl@c42165b5706e42f67ef8ef4c351a9a4c5d21639a` (CVE-2022-3786), which rewrote `ossl_a2ulabel()` around a bounded `PUSHC` macro.\n\n**alt-nodejs14 14.21.3 — bundled OpenSSL version and component absence**\n- `node-v14.21.3/deps/openssl/openssl/include/openssl/opensslv.h:43` → `OPENSSL_VERSION_TEXT \"OpenSSL 1.1.1t 7 Feb 2023\"` (`:42` → `0x1010114fL`).\n- `deps/openssl/openssl/crypto/punycode.c` and `include/crypto/punycode.h`: **do not exist** in the tarball (tar listing returns no match). These are the file the fix touches and its header.\n- 0 occurrences of `ossl_punycode_decode|ossl_a2ulabel|SmtpUTF8Mailbox|nc_email_eai` across the entire `deps/openssl/` tree — the vulnerable function, its caller, and the OpenSSL 3.0 IDNA name-constraint entry points are all absent, not renamed.\n- Behavioral-equivalence check: the 1.1.1 rfc822Name name-constraint handler `nc_email()` (declared `deps/openssl/openssl/crypto/x509v3/v3_ncons.c:35`, 705-line file, note the pre-3.0 path `crypto/x509v3/` rather than `crypto/x509/`) compares strings only via `ia5memrchr()`, `memchr()`, `strncmp()`, `ia5ncasecmp()` on the existing `ASN1_IA5STRING` buffers. There is no decode step and no fixed-size stack array written into, so the overflow sink (`unsigned int buf[LABEL_BUF_SIZE]`) has no equivalent. IDNA/punycode support in name constraints arrived only in OpenSSL 3.0.\n- Other punycode implementations in the tarball are unrelated to X.509 and unreachable from certificate verification: `deps/icu-small/source/common/punycode.cpp` (ICU IDNA for the JS `url`/`Intl` layer), `benchmark/misc/punycode.js`, and the vendored JS `punycode` package under `deps/npm/node_modules/{tough-cookie,uri-js}/node_modules/punycode/`.\n- `grep -c 'a2ulabel'` over `node-v14.21.3/src/*` → `0`: Node has no caller of the OpenSSL punycode API.\n- Build config: `alt-nodejs14/APKBUILD:167-169` → `--shared-openssl --shared-openssl-includes=/opt/alt/openssl11/include --shared-openssl-libpath=/opt/alt/openssl11/lib`; makedepends `alt-openssl11-dev` (`APKBUILD:33,46`). The bundled tree is never compiled; the linked library is the OpenSSL 1.1.1 line.\n\n**alt-nodejs16 16.20.2 — bundled OpenSSL version and component absence**\n- `node-v16.20.2/deps/openssl/openssl/include/openssl/opensslv.h:43` → `OPENSSL_VERSION_TEXT \"OpenSSL 1.1.1v+quic 1 Aug 2023\"` (`:42` → `0x1010116fL`).\n- `crypto/punycode.c` / `include/crypto/punycode.h`: **absent**; 0 hits for `ossl_punycode_decode|ossl_a2ulabel|SmtpUTF8Mailbox|nc_email_eai` across `deps/openssl/`.", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-dev-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-doc-14.21.3-r25.x86_64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.aarch64", "Alpine-Linux-3.24:alt-nodejs14-npm-14.21.3-r25.x86_64" ] }, { "category": "impact", "date": "2026-07-29T07:48:25.369293Z", "details": "Not vulnerable\n\nalt-nodejs16 16.20.2: NOT AFFECTED — this package never links a vulnerable OpenSSL. It is built with --shared-openssl (alt-nodejs16/APKBUILD:172, makedepends openssl-dev), so the vendored deps/openssl copy is not what ships; on alpinelinux3.23/3.24 node links Alpine's system OpenSSL 3.5.x. The punycode flaw affects only OpenSSL 3.0.0-3.0.6, and 3.5.x carries the bounds-checked ossl_a2ulabel. (Linkage pattern documented in ELS-2268.)\n\nPlatform in scope: alpinelinux3.24 (alt-nodejs16 16). Assessed against the shipped source and build configuration of alt-nodejs16, not NVD version ranges.\n\nEvidence\n**Which basis applies where.** For alt-nodejs14 and alt-nodejs16 the verdict rests on **absence of the vulnerable component** (not on absence of the fix). For alt-nodejs23 the component *is* present and the verdict rests on **presence of the fix**.\n\n**Upstream fix commit + first release**\n- `openssl/openssl@fe3b639dc19b325846f4f6801f2f4604f56e3de3` — \"Fix CVE-2022-3602 in punycode decoder.\" (Pauli, 2022-10-27), branch `openssl-3.0`. https://github.com/openssl/openssl/commit/fe3b639dc19b325846f4f6801f2f4604f56e3de3\n- First upstream release containing it: **OpenSSL 3.0.7** (`git tag --contains fe3b639` → earliest is `openssl-3.0.7`).\n- The fix is one line in `crypto/punycode.c`, `ossl_punycode_decode()`: `if (written_out > max_out)` → `if (written_out >= max_out)`.\n- Companion commit in the same release: `openssl/openssl@c42165b5706e42f67ef8ef4c351a9a4c5d21639a` (CVE-2022-3786), which rewrote `ossl_a2ulabel()` around a bounded `PUSHC` macro.\n\n**alt-nodejs14 14.21.3 — bundled OpenSSL version and component absence**\n- `node-v14.21.3/deps/openssl/openssl/include/openssl/opensslv.h:43` → `OPENSSL_VERSION_TEXT \"OpenSSL 1.1.1t 7 Feb 2023\"` (`:42` → `0x1010114fL`).\n- `deps/openssl/openssl/crypto/punycode.c` and `include/crypto/punycode.h`: **do not exist** in the tarball (tar listing returns no match). These are the file the fix touches and its header.\n- 0 occurrences of `ossl_punycode_decode|ossl_a2ulabel|SmtpUTF8Mailbox|nc_email_eai` across the entire `deps/openssl/` tree — the vulnerable function, its caller, and the OpenSSL 3.0 IDNA name-constraint entry points are all absent, not renamed.\n- Behavioral-equivalence check: the 1.1.1 rfc822Name name-constraint handler `nc_email()` (declared `deps/openssl/openssl/crypto/x509v3/v3_ncons.c:35`, 705-line file, note the pre-3.0 path `crypto/x509v3/` rather than `crypto/x509/`) compares strings only via `ia5memrchr()`, `memchr()`, `strncmp()`, `ia5ncasecmp()` on the existing `ASN1_IA5STRING` buffers. There is no decode step and no fixed-size stack array written into, so the overflow sink (`unsigned int buf[LABEL_BUF_SIZE]`) has no equivalent. IDNA/punycode support in name constraints arrived only in OpenSSL 3.0.\n- Other punycode implementations in the tarball are unrelated to X.509 and unreachable from certificate verification: `deps/icu-small/source/common/punycode.cpp` (ICU IDNA for the JS `url`/`Intl` layer), `benchmark/misc/punycode.js`, and the vendored JS `punycode` package under `deps/npm/node_modules/{tough-cookie,uri-js}/node_modules/punycode/`.\n- `grep -c 'a2ulabel'` over `node-v14.21.3/src/*` → `0`: Node has no caller of the OpenSSL punycode API.\n- Build config: `alt-nodejs14/APKBUILD:167-169` → `--shared-openssl --shared-openssl-includes=/opt/alt/openssl11/include --shared-openssl-libpath=/opt/alt/openssl11/lib`; makedepends `alt-openssl11-dev` (`APKBUILD:33,46`). The bundled tree is never compiled; the linked library is the OpenSSL 1.1.1 line.\n\n**alt-nodejs16 16.20.2 — bundled OpenSSL version and component absence**\n- `node-v16.20.2/deps/openssl/openssl/include/openssl/opensslv.h:43` → `OPENSSL_VERSION_TEXT \"OpenSSL 1.1.1v+quic 1 Aug 2023\"` (`:42` → `0x1010116fL`).\n- `crypto/punycode.c` / `include/crypto/punycode.h`: **absent**; 0 hits for `ossl_punycode_decode|ossl_a2ulabel|SmtpUTF8Mailbox|nc_email_eai` across `deps/openssl/`.\nLinkage note: this package is built with --shared-openssl, so affectedness is judged against the OpenSSL actually linked at runtime, not the vendored deps/openssl tree. See ELS-2268 for the per-platform linkage audit.", "product_ids": [ "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-dev-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-doc-16.20.2-r20.x86_64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.aarch64", "Alpine-Linux-3.24:alt-nodejs16-npm-16.20.2-r20.x86_64" ] } ] } ] }