Node.js < 12.22.9 < 14.18.3 < 16.13.2 and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name for example in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

🗓️ 05 Mar 2022 08:00:00Reported by MicrosoftType

Older Node.js versions misparse multi-value relative distinguished names, enabling common name injection.

Reporter	Title	Published	Views	Family All 385
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway potentially affected by various vulnerabilities in Node	29 Jul 202218:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in node.js	14 Apr 202215:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	25 Oct 202214:32	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of NodeJS, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities.	5 Sep 202311:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to string injection vulnerability due to Node.js (CVE-2021-44532, CVE-2021-44532 )	9 May 202223:23	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple CVEs in Node.js	8 Apr 202214:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in PostgreSQL, Node.js, and Data Tables from Spry Media may affect IBM Spectrum Protect Plus	31 Jan 202218:22	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-44532, CVE-2021-44533, CVE-2022-21824)	22 Apr 202220:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	15 Jul 202516:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Node.js affects IBM Netcool Agile Service Manager	1 Jun 202213:37	–	ibm

Vulners

Node

microsoft cbl2_nodejs_16.14.0-1Range<16.14.0-1

microsoft cm1_nodejs_14.18.3-1Range<14.18.3-1

05 Mar 2022 08:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 25

CVSS 3.15.3

EPSS0.00364