DeutschShown in its original language — a full translation is planned for a future version.
Node.js: Mehrere Schwachstellen
view advisory published 2021-08-11
Ein Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting Angriff durchzuführen, einen Denial of Service Zustand herzustellen und Sicherheitsmaßnahmen zu umgehen.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-22940US | high7.5 | — | ||
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. | ||||
| CVE-2021-22939US | medium5.3 | — | ||
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired… | ||||
| CVE-2021-22931US | critical9.8 | — | ||
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name S… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2021-3623 vom 2021-09-22external
- Oracle Linux Security Advisory ELSA-2021-3666 vom 2021-09-28external
- Red Hat Security Advisory RHSA-2021:3280 vom 2021-08-26external
- Red Hat Security Advisory RHSA-2021:3281 vom 2021-08-26external
- Red Hat Security Advisory RHSA-2021:3623 vom 2021-09-21external
- Red Hat Security Advisory RHSA-2021:3638 vom 2021-09-22external
- Red Hat Security Advisory RHSA-2021:3639 vom 2021-09-22external
- Red Hat Security Advisory RHSA-2021:3666 vom 2021-09-28external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan