Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
References
| Link | Resource |
|---|---|
| https://hackerone.com/reports/1429694 | Issue Tracking Mitigation Patch Third Party Advisory |
| https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ | Release Notes Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220325-0007/ | Third Party Advisory |
| https://www.debian.org/security/2022/dsa-5170 | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Patch Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
05 Oct 2022, 13:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Oracle mysql Workbench
Oracle mysql Connectors Oracle graalvm Oracle mysql Server Oracle mysql Cluster Oracle Oracle mysql Enterprise Monitor Oracle peoplesoft Enterprise Peopletools |
|
| References | (N/A) https://www.oracle.com/security-alerts/cpujul2022.html - Third Party Advisory | |
| References | (DEBIAN) https://www.debian.org/security/2022/dsa-5170 - Third Party Advisory | |
| References | (MISC) https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* |
25 Jul 2022, 18:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Jun 2022, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Apr 2022, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Apr 2022, 19:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220325-0007/ - Third Party Advisory |
25 Mar 2022, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Mar 2022, 17:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | |
| References | (MISC) https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ - Release Notes, Vendor Advisory | |
| References | (MISC) https://hackerone.com/reports/1429694 - Issue Tracking, Mitigation, Patch, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.8
v3 : 7.4 |
| CWE | CWE-295 | |
| First Time |
Nodejs
Nodejs node.js |
24 Feb 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-24 19:15
Updated : 2023-12-10 14:22
NVD link : CVE-2021-44531
Mitre link : CVE-2021-44531
CVE.ORG link : CVE-2021-44531
JSON object : View
Products Affected
oracle
- mysql_connectors
- graalvm
- mysql_cluster
- mysql_enterprise_monitor
- peoplesoft_enterprise_peopletools
- mysql_server
- mysql_workbench
nodejs
- node.js
CWE
CWE-295
Improper Certificate Validation