CVE-2021-44533

CWE-295 — Improper Certificate Validation6 documents6 sources
Severity
5.3MEDIUM
EPSS
0.4%
top 38.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Nodejs NodeNodejs Node.jsOracle Mysql Cluster+7 more
Timeline
PublishedFeb 24
Latest updateApr 15

Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thu…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages10 packages

▶CVEListV5nodejs/node4.0 — 4.*+13
▶NVDnodejs/node.js14.0.0 — 14.18.3+3
▶Debiannodejs< 12.22.12~dfsg-1~deb11u1+3
▶NVDoracle/mysql_cluster< 8.0.29+1
▶NVDoracle/mysql_server8.0.0 — 8.0.28+1

Also affects: Debian Linux 11.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2021-44533: Node↗2022-02-24
▶
OSV
CVE-2021-44533: Node↗2022-02-24
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Elastic Search (Node.js) — CVE-2021-44533↗2022-04-15
▶
Red Hat
nodejs: Incorrect handling of certificate subject and issuer fields↗2022-01-10
▶
Debian
CVE-2021-44533: nodejs - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value...↗2021
▶