DeutschShown in its original language — a full translation is planned for a future version.
Node.js: Mehrere Schwachstellen
view advisory published 2022-01-10
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder Dateien zu manipulieren.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-21824US | high8.2 | — | ||
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing… | ||||
| CVE-2021-44533US | medium5.3 | — | ||
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a sin… | ||||
| CVE-2021-44532US | medium5.3 | — | ||
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames… | ||||
| CVE-2021-44531US | high7.4 | — | ||
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates.… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2022-9073 vom 2022-12-17external
- Red Hat Security Advisory RHSA-2022:4914 vom 2022-06-06external
- Red Hat Security Advisory RHSA-2022:7044 vom 2022-10-19external
- Red Hat Security Advisory RHSA-2022:7830 vom 2022-11-08external
- Red Hat Security Advisory RHSA-2022:9073 vom 2022-12-15external
- Red Hat Security Advisory RHSA-2023:1742 vom 2023-04-12external
- Amazon Linux Security Advisory ALAS-2022-019 vom 2022-02-03external
- Amazon Linux Security Advisory ALAS-2022-214 vom 2022-12-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan