SecuritySpace - CVE-2024-21892

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2024-21892

Description: On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.

Test IDs: 1.3.6.1.4.1.25623.1.1.10.2024.0046

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2024-21892
https://hackerone.com/reports/2237545
https://hackerone.com/reports/2237545
http://www.openwall.com/lists/oss-security/2024/03/11/1

CVE ID:	CVE-2024-21892
Description:	On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. This allows unprivileged users to inject code that inherits the process's elevated privileges.
Test IDs:	1.3.6.1.4.1.25623.1.1.10.2024.0046
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2024-21892 https://hackerone.com/reports/2237545 https://hackerone.com/reports/2237545 http://www.openwall.com/lists/oss-security/2024/03/11/1