CVE-2021-44533

Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

CVSS breakdown

Affected products

• Debian / debian_linux11.0 – 11.0
• nodejs / node5.0 – 5.*
• nodejs / node6.0 – 6.*
• nodejs / node7.0 – 7.*
• nodejs / node8.0 – 8.*
• nodejs / node9.0 – 9.*
• nodejs / node10.0 – 10.*
• nodejs / node11.0 – 11.*
• nodejs / node12.0 – 12.22.9
• nodejs / node13.0 – 13.*
• nodejs / node14.0 – 14.18.3
• nodejs / node15.0 – 15.*
• nodejs / node16.0 – 16.13.2
• nodejs / node4.0 – 4.*
• nodejs / node17.0 – 17.3.1
• nodejs / node.js12.22.9
• oracle / graalvm21.3.1 – 21.3.1
• oracle / graalvm22.0.0.2 – 22.0.0.2
• oracle / graalvm20.3.5 – 20.3.5
• oracle / mysql_cluster8.0.29 – 8.0.29
• oracle / mysql_cluster8.0.29
• oracle / mysql_connectors8.0.28
• oracle / MySQL Enterprise Monitor8.0.29
• oracle / mysql_server5.7.37
• oracle / mysql_workbench8.0.28
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• oracle / peoplesoft_enterprise_peopletools8.59 – 8.59

References

• MISChttps://hackerone.com/reports/1429694
• MISChttps://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
• MISChttps://security.netapp.com/advisory/ntap-20220325-0007/
• VENDOR_ADVISORYhttps://www.debian.org/security/2022/dsa-5170
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html