CVE Vulnerabilities

CVE-2021-22939

Improper Certificate Validation

Published: Aug 16, 2021 | Modified: Jan 05, 2024
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
3.7 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Ubuntu
LOW

If the Node.js https API was used incorrectly and undefined was in passed for the rejectUnauthorized parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

Name Vendor Start Version End Version
Node.js Nodejs 12.0.0 (including) 12.22.5 (excluding)
Node.js Nodejs 14.0.0 (including) 14.17.5 (excluding)
Node.js Nodejs 16.0.0 (including) 16.6.2 (excluding)
Red Hat Enterprise Linux 8 RedHat nodejs:12-8040020210817133458.522a0ee4 *
Red Hat Enterprise Linux 8 RedHat nodejs:14-8040020210817165654.522a0ee4 *
Red Hat Enterprise Linux 8.1 Extended Update Support RedHat nodejs:12-8010020210817113128.c27ad7f8 *
Red Hat Enterprise Linux 8.2 Extended Update Support RedHat nodejs:12-8020020210817125332.4cda2c84 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs14-nodejs-0:14.17.5-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs12-nodejs-0:12.22.5-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs12-nodejs-nodemon-0:2.0.3-5.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs14-nodejs-0:14.17.5-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs12-nodejs-0:12.22.5-1.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS RedHat rh-nodejs12-nodejs-nodemon-0:2.0.3-5.el7 *
Nodejs Ubuntu bionic *
Nodejs Ubuntu hirsute *
Nodejs Ubuntu impish *
Nodejs Ubuntu kinetic *
Nodejs Ubuntu trusty *
Nodejs Ubuntu trusty/esm *
Nodejs Ubuntu upstream *
Nodejs Ubuntu xenial *

Potential Mitigations

References