CVE-2023-23919: Multiple OpenSSL error handling issues in nodejs crypto library

Summary

Node.js OpenSSL error handling issues in nodejs crypto library (Medium) (CVE-2023-23919)

In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

Thank you, to Morgan Jones and Ryan Dorrity from Viasat Secure Mobile for reporting and discovering this vulnerability and thank you Rafael Gonzaga for fixing it.

Impacts:

Versions of < 19.2.0 and lower of the 19.x release line and all versions of the 18.x, and 16.x release lines.

Full Security Advisory: https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/