CVE-2021-44533

CVE-2021-44533 affects Node.js by improper handling of multi-value Relative Distinguished Names, potentially allowing bypass of certificate subject verification. Affected are Node.js versions < 12.22.9, < 14.18.3, < 16.13.2, and

CVE-2021-44533

Node.js 12.22.9, 14.18.3, 16.13.2, and 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in...

CVE-2021-44531

Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js 12.22.9, 14.18.3, 16.13.2, and 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use...

CVE-2021-44533: Improper Certificate Validation

Node.js 12.22.9, 14.18.3, 16.13.2, and 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in...

Updated nodejs packages fix security vulnerability

Improper handling of URI Subject Alternative Names Medium. Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often n...

MGASA-2022-0077 Updated nodejs packages fix security vulnerability

Improper handling of URI Subject Alternative Names Medium. Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often n...

Envoy 信任管理问题漏洞

Envoy is an open source distributed proxy server. Envoy has a trust management issue vulnerability that stems from a type confusion error in the defaultvalidator.cc implementation used to implement the default certificate validation routines when handling subjectAltNames. no details of the...

Build a privacy-resilient workplace with Microsoft Priva

Today, we celebrate international Data Privacy Day. This day reminds us of the importance of respecting privacy, safeguarding data, and enabling trust. However, annual reminders are insufficient to drive material change, which can be seen in the effectiveness rates of one-off trainings. According...

Build a privacy-resilient workplace with Microsoft Priva

Today, we celebrate international Data Privacy Day. This day reminds us of the importance of respecting privacy, safeguarding data, and enabling trust. However, annual reminders are insufficient to drive material change, which can be seen in the effectiveness rates of one-off trainings. According...

Mageia: Security Advisory (MGASA-2014-0557)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2022:0113-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0113-1 advisory. - Accepting arbitrary Subject Alternative Name SAN types, unless a PKI is specifically defined to use a particular SAN type, can result in...

CVE-2021-38695

SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting XSS that allows users to store scripts in certain fields e.g. subject, description of the document form...

CVE-2021-38695

SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting XSS that allows users to store scripts in certain fields e.g. subject, description of the document form...

SUSE-SU-2022:0114-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names bsc1194511. - CVE-2021-44532: Fixed certificate Verification Bypass via String Injection bsc1194512. - CVE-2021-44533: Fixed incorrect handling of certificate subject an...

SUSE-SU-2022:0113-1 Security update for nodejs12

This update for nodejs12 fixes the following issues: - CVE-2021-44531: Fixed improper handling of URI Subject Alternative Names bsc1194511. - CVE-2021-44532: Fixed certificate Verification Bypass via String Injection bsc1194512. - CVE-2021-44533: Fixed incorrect handling of certificate subject an...

CVE-2021-38695: Improper Neutralization of Input During Web Page Generation

SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting XSS that allows users to store scripts in certain fields e.g. subject, description of the document form...

Improper Certificate Validation

nodejs is vulnerable to Improper Certificate Validation. The vulnerability exists due to insufficient validation of URI subject alternative names which allows an attacker to bypass the certificate subject verification...

OpenSSL 3.0.0 < 3.0.1 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.1 advisory. - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the...

Invalid handling of `X509_verify_cert()` internal errors in libssl

Internally libssl in OpenSSL calls X509verifycert on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error for example out of memory. Such a negative return value is mishandled by OpenSSL and will cause an IO...

Finding My Way as an Akamai Intern

It’s an exciting time to be starting a career in digital – but even more so when it’s at a company like Akamai. An organization driven by a commitment to developing talent within the industry, Akamai is an intellectually rigorous, demanding, and rewarding environment to be in at any level. But fo...