Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses nodes ambiguous presentation of certificate subjects may be vulnerable.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Node.js | Nodejs | * | 12.22.9 (excluding) |
| Node.js | Nodejs | 14.0.0 (including) | 14.18.3 (excluding) |
| Node.js | Nodejs | 16.0.0 (including) | 16.13.2 (excluding) |
| Node.js | Nodejs | 17.0.0 (including) | 17.3.1 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:12-8060020220523160029.ad008a3a | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:14-8070020221020110846.bd1311ed | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:16-8070020221207164159.bd1311ed | * |
| Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | RedHat | nodejs:12-8010020220518102644.c27ad7f8 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | nodejs:12-8020020220523154454.4cda2c84 | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | nodejs:12-8040020220523155137.522a0ee4 | * |
| Red Hat Enterprise Linux 8.6 Extended Update Support | RedHat | nodejs:14-8060020230306170237.ad008a3a | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs12-nodejs-0:12.22.12-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs14-nodejs-0:14.20.1-2.el7 | * |
| RHODF-4.13-RHEL-9 | RedHat | odf4/mcg-core-rhel9:v4.13.0-41 | * |
| Nodejs | Ubuntu | bionic | * |
| Nodejs | Ubuntu | esm-apps/focal | * |
| Nodejs | Ubuntu | focal | * |
| Nodejs | Ubuntu | hirsute | * |
| Nodejs | Ubuntu | impish | * |
| Nodejs | Ubuntu | kinetic | * |
| Nodejs | Ubuntu | lunar | * |
| Nodejs | Ubuntu | mantic | * |
| Nodejs | Ubuntu | trusty | * |
| Nodejs | Ubuntu | trusty/esm | * |
| Nodejs | Ubuntu | upstream | * |
| Nodejs | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
References
- https://hackerone.com/reports/1429694
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
- https://security.netapp.com/advisory/ntap-20220325-0007/
- https://www.debian.org/security/2022/dsa-5170
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://hackerone.com/reports/1429694
- https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
- https://security.netapp.com/advisory/ntap-20220325-0007/
- https://www.debian.org/security/2022/dsa-5170
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html