If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-22939US | medium5.3 | — | ||
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired… | ||||
02
references
External citations — patches, advisories, analysis.
- https://hackerone.com/reports/1278254ADVISORY
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.htmlADVISORY
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2021-22939WEB
- https://security.gentoo.org/glsa/202401-02WEB
- https://security.netapp.com/advisory/ntap-20210917-0003/ADVISORY
- https://www.oracle.com/security-alerts/cpujan2022.htmlADVISORY
- https://www.oracle.com/security-alerts/cpujul2022.htmlADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan