Lucene search

K
archlinuxArchLinuxASA-202110-6
HistoryOct 21, 2021 - 12:00 a.m.

[ASA-202110-6] nodejs-lts-erbium: multiple issues

2021-10-2100:00:00
security.archlinux.org
28

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.008 Low

EPSS

Percentile

81.3%

Arch Linux Security Advisory ASA-202110-6

Severity: High
Date : 2021-10-21
CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960
Package : nodejs-lts-erbium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2285

Summary

The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to
multiple issues including arbitrary code execution, url request
injection and certificate verification bypass.

Resolution

Upgrade to 12.22.7-1.

pacman -Syu “nodejs-lts-erbium>=12.22.7-1”

The problems have been fixed upstream in version 12.22.7.

Workaround

None.

Description

  • CVE-2021-22939 (certificate verification bypass)

If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5
was used incorrectly and “undefined” was in passed for the
“rejectUnauthorized” parameter, no error was returned and connections
to servers with an expired certificate would have been accepted.

  • CVE-2021-22940 (arbitrary code execution)

Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a
use after free attack where an attacker might be able to exploit memory
corruption to change process behavior. The issue is a follow on to
CVE-2021-22930 as the issue was not completely resolved in the fix for
CVE-2021-22930.

  • CVE-2021-22959 (url request injection)

A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The http parser accepts requests with a space (SP)
right after the header name before the colon. This can lead to HTTP
Request Smuggling (HRS).

  • CVE-2021-22960 (url request injection)

A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing
the body of chunked requests. This leads to HTTP Request Smuggling
(HRS) under certain conditions.

Impact

Incorrect use of the https API could lead to expired certificates being
accepted. Furthermore a remote attacker could execute arbitrary code or
inject HTTP requests through crafted queries.

References

https://bugs.archlinux.org/task/72412
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939
https://hackerone.com/reports/1278254
https://github.com/nodejs-private/node-private/pull/276
https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80
https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6
https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940
https://github.com/nodejs/node/pull/39423
https://github.com/nodejs/node/pull/39622
https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6
https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
https://hackerone.com/reports/1238099
https://hackerone.com/reports/1238709
https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
https://security.archlinux.org/CVE-2021-22939
https://security.archlinux.org/CVE-2021-22940
https://security.archlinux.org/CVE-2021-22959
https://security.archlinux.org/CVE-2021-22960

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanynodejs-lts-erbium< 12.22.7-1UNKNOWN

References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.008 Low

EPSS

Percentile

81.3%