Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-44533

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Published

2022-02-24T19:15:09.407

Last Modified

2024-11-21T06:31:10.940

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-295
  • Type: Primary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application nodejs node.js < 12.22.9 Yes
Application nodejs node.js < 14.18.3 Yes
Application nodejs node.js < 16.13.2 Yes
Application nodejs node.js < 17.3.1 Yes
Application oracle graalvm 20.3.5 Yes
Application oracle graalvm 21.3.1 Yes
Application oracle graalvm 22.0.0.2 Yes
Application oracle mysql_cluster < 8.0.29 Yes
Application oracle mysql_cluster 8.0.29 Yes
Application oracle mysql_connectors ≤ 8.0.28 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.29 Yes
Application oracle mysql_server ≤ 5.7.37 Yes
Application oracle mysql_server ≤ 8.0.28 Yes
Application oracle mysql_workbench ≤ 8.0.28 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Operating System debian debian_linux 11.0 Yes
References