CVE-2021-22939
published 2021-08-16CVE-2021-22939: If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to…
PriorityP434medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
14.73%
96.3th percentile
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | nodejs | < nodejs 12.22.5~dfsg-1 (bookworm) | nodejs 12.22.5~dfsg-1 (bookworm) |
| msrc | cbl2_nodejs_16.14.0-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_nodejs_14.17.5-1_on_cbl_mariner_1.0 | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.22.5 | 12.22.5 |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.17.5 | 14.17.5 |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.6.2 | 16.6.2 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
| nodejs | node | >= 9.0 < 9.* | 9.* |
| nodejs | node.js | >= 12.0.0 < 12.22.5 | 12.22.5 |
| nodejs | node.js | >= 14.0.0 < 14.17.5 | 14.17.5 |
| nodejs | node.js | >= 16.0.0 < 16.6.2 | 16.6.2 |
| nodejs | nodejs | >= 0 < 12.22.5~dfsg-2~11u1 | 12.22.5~dfsg-2~11u1 |
| nodejs | nodejs | >= 0 < 12.22.5~dfsg-1 | 12.22.5~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.22.5~dfsg-1 | 12.22.5~dfsg-1 |
| nodejs | nodejs | >= 0 < 12.22.5~dfsg-1 | 12.22.5~dfsg-1 |
| oracle | graalvm | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9mvv-4q4j-q2j8: If the Node
ghsa_unreviewed·2022-05-24
CVE-2021-22939 [MEDIUM] CWE-295 GHSA-9mvv-4q4j-q2j8: If the Node
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
OSV
CVE-2021-22939: If the Node
osv·2021-08-16·CVSS 5.3
CVE-2021-22939 [MEDIUM] CVE-2021-22939: If the Node
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Red Hat
nodejs: Incomplete validation of tls rejectUnauthorized parameter
vendor_redhat·2021-08-11·CVSS 5.3
CVE-2021-22939 [MEDIUM] CWE-20 nodejs: Incomplete validation of tls rejectUnauthorized parameter
nodejs: Incomplete validation of tls rejectUnauthorized parameter
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
A flaw was found in Node.js. If the Node.js HTTPS API is used incorrectly and "undefined" is passed for the "rejectUnauthorized" parameter, no error is returned, and the connections to servers with an expired certificate are accepted. The highest threat from this vulnerability is to integrity.
Statement: Red Hat Quay from version 3.4 consumes nodejs from RHEL, so security tracking is provided by the container health index on the customer portal [1]. Additionally there is no impact from this issue on Quay 3.
Microsoft
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter no error was returned and connections to servers with an expired certificate would ha
vendor_msrc·2021-08-10·CVSS 5.3
CVE-2021-22939 [MEDIUM] CWE-295 If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter no error was returned and connections to servers with an expired certificate would ha
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter no error was returned and connections to servers with an expired certificate would have been accepted.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, w
Debian
CVE-2021-22939: nodejs - If the Node.js https API was used incorrectly and "undefined" was in passed for ...
vendor_debian·2021·CVSS 5.3
CVE-2021-22939 [MEDIUM] CVE-2021-22939: nodejs - If the Node.js https API was used incorrectly and "undefined" was in passed for ...
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Scope: local
bookworm: resolved (fixed in 12.22.5~dfsg-1)
bullseye: resolved (fixed in 12.22.5~dfsg-2~11u1)
forky: resolved (fixed in 12.22.5~dfsg-1)
sid: resolved (fixed in 12.22.5~dfsg-1)
trixie: resolved (fixed in 12.22.5~dfsg-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1278254https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlhttps://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/https://security.gentoo.org/glsa/202401-02https://security.netapp.com/advisory/ntap-20210917-0003/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://hackerone.com/reports/1278254https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlhttps://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/https://security.gentoo.org/glsa/202401-02https://security.netapp.com/advisory/ntap-20210917-0003/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-08-16
Published