CVE-2021-44533 describes a vulnerability in Node.js versions prior to 12.22.9, 14.18.3, 16.13.2, and 17.3.1, affecting products like Debian and Oracle. This flaw stems from incorrect handling of multi-value Relative Distinguished Names, allowing attackers to craft certificate subjects that could bypass certificate subject verification. Rated as Medium severity (CVSS 5.3), it has a low attack complexity and could lead to information integrity issues, though it does not impact confidentiality or availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 12.22.9CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 14.0.0, < 14.18.3CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 16.0.0, < 16.13.2CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
>= 17.0.0, < 17.3.1CPE matchmatch criteria | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | ||
20.3.5CPE matchmatch criteria | cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2021-44533
Mar 8, 2022Node.js < 12.22.9 < 14.18.3 < 16.13.2 and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name for example in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
Feb 8, 2022nodejs: Incorrect handling of certificate subject and issuer fields
Jan 10, 2022