The vulnerability of the implementation for specifying all domain names and IP addresses using Subject Alternative Names in the Node.js software platform allows attackers to perform spoofing attacks.

🗓️ 16 Feb 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Node.js SAN validation flaw enables remote spoofing via exposure of all domain names and internet protocol addresses.

Reporter	Title	Published	Views	Family All 396
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	14 Apr 202215:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway affected by vulnerability in Node (CVE-2021-44531)	29 Jul 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of NodeJS, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities.	5 Sep 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js	8 Apr 202214:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PostgreSQL, Node.js, and Data Tables from Spry Media may affect IBM Spectrum Protect Plus	31 Jan 202218:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2021-4104, CVE-2021-29469, CVE-2021-44531, CVE-2021-44531, CVE-2022-21824, CVE-2021-29899, CVE-2021-27290 )	17 Mar 202215:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to CVE-2021-44531	4 Nov 202216:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm

Vulners

Node

red_hat red_hat_quayMatch3

red_hat red_hat_openshift_dataMatch4

node.js node.jsRange12–12.22.9

node.js node.jsRange14–14.18.3

node.js node.jsRange17–17.3.1

node.js node.jsRange16–16.13.2

red_hat red_hat_enterprise_linuxMatch8

fedora fedoraMatch34

fedora fedoraMatch35

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-programmnoy-platformy-node-js-cve-2021-44531-cve-2021-44532-cve-2021-44533-cve-2022-21824/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/cve-2021-44531
nodejs	www.nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
vulners	www.vulners.com/ubuntucve/UB:CVE-2021-44531
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2022-0eda327cb4
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2022-78090d2099
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-MODULAR-2022-1a016f9102
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-MODULAR-2022-b5d5c5a7b8
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-MODULAR-2022-f399a3794d

16 Feb 2022 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 27.1

CVSS 37.4

EPSS0.08373