Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-44531

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

Published

2022-02-24T19:15:09.313

Last Modified

2024-11-21T06:31:10.550

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

4.9

Weaknesses
  • Type: Secondary
    CWE-295
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application nodejs node.js < 12.22.9 Yes
Application nodejs node.js < 14.18.3 Yes
Application nodejs node.js < 16.13.2 Yes
Application nodejs node.js < 17.3.1 Yes
Application oracle graalvm 20.3.5 Yes
Application oracle graalvm 21.3.1 Yes
Application oracle graalvm 22.0.0.2 Yes
Application oracle mysql_connectors ≤ 8.0.28 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.29 Yes
Application oracle mysql_server ≤ 5.7.37 Yes
Application oracle mysql_server ≤ 8.0.28 Yes
Application oracle mysql_workbench ≤ 8.0.28 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Application oracle mysql_cluster ≤ 8.0.29 Yes
References