CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate…

medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Affected

36 ranges· showing 25

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	nodejs	< nodejs 12.22.9~dfsg-1 (bookworm)	nodejs 12.22.9~dfsg-1 (bookworm)
nodejs	node	>= 10.0 < 10.*	10.*
nodejs	node	>= 11.0 < 11.*	11.*
nodejs	node	>= 12.0 < 12.22.9	12.22.9
nodejs	node	>= 13.0 < 13.*	13.*
nodejs	node	>= 14.0 < 14.18.3	14.18.3
nodejs	node	>= 15.0 < 15.*	15.*
nodejs	node	>= 16.0 < 16.13.2	16.13.2
nodejs	node	>= 17.0 < 17.3.1	17.3.1
nodejs	node	>= 4.0 < 4.*	4.*
nodejs	node	>= 5.0 < 5.*	5.*
nodejs	node	>= 6.0 < 6.*	6.*
nodejs	node	>= 7.0 < 7.*	7.*
nodejs	node	>= 8.0 < 8.*	8.*
nodejs	node	>= 9.0 < 9.*	9.*
nodejs	node.js	< 12.22.9	12.22.9
nodejs	node.js	>= 14.0.0 < 14.18.3	14.18.3
nodejs	node.js	>= 16.0.0 < 16.13.2	16.13.2
nodejs	node.js	>= 17.0.0 < 17.3.1	17.3.1
nodejs	nodejs	>= 0 < 12.22.12~dfsg-1~deb11u1	12.22.12~dfsg-1~deb11u1
nodejs	nodejs	>= 0 < 12.22.9~dfsg-1	12.22.9~dfsg-1
nodejs	nodejs	>= 0 < 12.22.9~dfsg-1	12.22.9~dfsg-1
nodejs	nodejs	>= 0 < 12.22.9~dfsg-1	12.22.9~dfsg-1
oracle	graalvm	—	—

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

osv5.3MEDIUM