CVE-2021-44532

Katalog CVE

CVSS 5.3 · Medium EPSS 10,4%

Kerentanan Improper Following of a Certificate's Chain of Trust pada nodejs node.js, oracle graalvm +7 lainnya. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.

Rincian

Terbit di NVD

24 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-296: Improper Following of a Certificate's Chain of Trust
CWE-295: Improper Certificate Validation

EPSS (30 hari)

10,4% peluang dieksploitasi; lebih tinggi dari 95,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ exploit · release notes · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://hackerone.com/reports/1429694 mitigasi · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220325-0007/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5170 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2022.html advisory pihak ketiga