Vulnerability · Published Feb 24, 2022 · Assigned by hackerone
CVE-2021-44531
High 7.4
In plain English
A high-severity improper certificate validation in Node from NodeJS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.4% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | nodejs | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 | ALSA-2022:7830 |
| AlmaLinux:8 | nodejs | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 |
| AlmaLinux:8 | nodejs-devel | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 | ALSA-2022:7830 |
| AlmaLinux:8 | nodejs-devel | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 |
| AlmaLinux:8 | nodejs-docs | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 | ALSA-2022:7830 |
| AlmaLinux:8 | nodejs-docs | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 |
| AlmaLinux:8 | nodejs-full-i18n | 1:14.20.1-2.module_el8.7.0+3342+b2df8497 | ALSA-2022:7830 |
| AlmaLinux:8 | nodejs-full-i18n | 1:16.18.1-3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.19-2.module_el8.6.0+3261+490666b3 | ALSA-2022:7830 |
| AlmaLinux:8 | nodejs-nodemon | 2.0.20-2.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 |
| AlmaLinux:8 | nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 | ALSA-2022:7830 |
| AlmaLinux:8 | nodejs-packaging | 25-1.module_el8.5.0+2605+45d748af | ALSA-2022:9073 |
| AlmaLinux:8 | npm | 1:6.14.17-1.14.20.1.2.module_el8.7.0+3342+b2df8497 | ALSA-2022:7830 |
| AlmaLinux:8 | npm | 1:8.19.2-1.16.18.1.3.module_el8.7.0+3371+ed8c43db | ALSA-2022:9073 |
| Alpine:v3.20 | nodejs | 16.13.2-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.21 | nodejs | 16.13.2-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.22 | nodejs | 16.13.2-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.23 | nodejs | 16.13.2-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.24 | nodejs | 16.13.2-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.20 | nodejs-current | 17.3.1-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.21 | nodejs-current | 17.3.1-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.22 | nodejs-current | 17.3.1-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.23 | nodejs-current | 17.3.1-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.24 | nodejs-current | 17.3.1-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.20 | openjdk11 | 11.0.15_p10-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.21 | openjdk11 | 11.0.15_p10-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.22 | openjdk11 | 11.0.15_p10-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.23 | openjdk11 | 11.0.15_p10-r0 | ALPINE-CVE-2021-44531 |
| Alpine:v3.24 | openjdk11 | 11.0.15_p10-r0 | ALPINE-CVE-2021-44531 |
| Debian:12 | nodejs | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44531 |
| Debian:13 | nodejs | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44531 |
| Debian:14 | nodejs | 12.22.9~dfsg-1 | DEBIAN-CVE-2021-44531 |
| Rocky Linux:8 | nodejs | 1:16.18.1-3.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 |
| Rocky Linux:8 | nodejs | 1:14.20.1-2.module+el8.7.0+1071+4bdda2a8 | RLSA-2022:7830 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+1003+ae94235a | RLSA-2022:7830 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.20-2.module+el8.7.0+1108+49363b0d | RLSA-2022:9073 |
| Rocky Linux:8 | nodejs-nodemon | 0:2.0.19-2.module+el8.6.0+1046+80feca58 | RLSA-2022:7830 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.5.0+702+221f14e6 | RLSA-2022:9073 |
| Rocky Linux:8 | nodejs-packaging | 0:25-1.module+el8.6.0+1046+80feca58 | RLSA-2022:9073 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.5.0+733+de4fee6c | RLSA-2022:7830 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.3.0+100+234774f7 | RLSA-2022:7830 |
| Rocky Linux:8 | nodejs-packaging | 0:23-3.module+el8.7.0+1071+4bdda2a8 | RLSA-2022:7830 |
| Ubuntu:22.04:LTS | nodejs | 12.22.9~dfsg-1ubuntu3.6 | UBUNTU-CVE-2021-44531 |
| Ubuntu:24.04:LTS | nodejs | 18.19.1+dfsg-6ubuntu5 | UBUNTU-CVE-2021-44531 |
Affected products (as reported)
Weakness: CWE-295
References
- https://hackerone.com/reports/1429694 x_refsource_MISC
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/ x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20220325-0007/ x_refsource_CONFIRM
- DSA-5170 vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com/security-alerts/cpujul2022.html x_refsource_MISC