Vulnerability Description
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nodejs | Node.Js | < 12.22.9 |
| Oracle | Graalvm | 20.3.5 |
| Oracle | Mysql Cluster | <= 8.0.29 |
| Oracle | Mysql Connectors | <= 8.0.28 |
| Oracle | Mysql Enterprise Monitor | <= 8.0.29 |
| Oracle | Mysql Server | <= 5.7.37 |
| Oracle | Mysql Workbench | >= 8.0.0, <= 8.0.28 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.58 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://hackerone.com/reports/1429694MitigationThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ExploitRelease NotesVendor Advisory
- https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5170Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://hackerone.com/reports/1429694MitigationThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ExploitRelease NotesVendor Advisory
- https://security.netapp.com/advisory/ntap-20220325-0007/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5170Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
FAQ
What is CVE-2021-44532?
CVE-2021-44532 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating con...
How severe is CVE-2021-44532?
CVE-2021-44532 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-44532?
Check the references section above for vendor advisories and patch information. Affected products include: Nodejs Node.Js, Oracle Graalvm, Oracle Mysql Cluster, Oracle Mysql Connectors, Oracle Mysql Enterprise Monitor.