Lucene search

K

HackeroneCVELIST:CVE-2021-22939

HistoryAug 16, 2021 - 12:00 a.m.

CVE-2021-22939

2021-08-1600:00:00

CWE-295

hackerone

www.cve.org

5

cve-2021-22939

node.js

https

api

security

vulnerability

rejectunauthorized

parameter

expired certificate

AI Score

7.7

Confidence

High

EPSS

0.011

Percentile

84.5%

If the Node.js https API was used incorrectly and “undefined” was in passed for the “rejectUnauthorized” parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed version 16.6.2, 14.17.5, and 12.22.5",
        "status": "affected"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

hackerone.com/reports/1278254

lists.debian.org/debian-lts-announce/2022/10/msg00006.html

nodejs.org/en/blog/vulnerability/aug-2021-security-releases/

security.gentoo.org/glsa/202401-02

security.netapp.com/advisory/ntap-20210917-0003/

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpujul2022.html

www.oracle.com/security-alerts/cpuoct2021.html

AI Score

7.7

Confidence

High

EPSS

0.011

Percentile

84.5%

Related for CVELIST:CVE-2021-22939