CVE-2022-3602

OpenSSL CVE-2022-3602 is a stack-based buffer overrun in X.509 name-contraint verification that can crash a TLS client/server or, potentially, allow RCE. The issue is triggered by crafting an email address and affects OpenSSL 3.0.x (3.0.0–3.0.6). Mitigation is upgrading to OpenSSL 3.0.7 or later ...

CVE-2022-3786

OpenSSL CVE-2022-3602 and CVE-2022-3786 describe buffer overflows in X.509 name-constraint processing triggered by crafted email addresses in certificates, potentially crashing the TLS client/server and, in some scenarios, enabling remote code execution. Documents confirm the issues affect OpenSS...

CVE-2022-43548

CVE-2022-43548 affects Node.js and is caused by an insufficient IsAllowedHost check, allowing rebinding attacks via invalid IP addresses (notably octal formats) when using --inspect. Impact is DNS rebinding leading to potential code execution in affected environments. Affected versions include No...

CVE-2022-35256

CVE-2022-35256 concerns the llhttp parser used by Node.js (http module) where header fields not terminated with CRLF can enable HTTP Request Smuggling. The issue is present in Node.js builds that include the llhttp version affected and has been addressed by package updates in multiple distributio...

CVE-2022-32212

CVE-2022-32212 is a Node.js OS Command Injection due to an insufficient IsAllowedHost validation, enabling rebinding attacks. Affected versions are Node.js <14.20.0, <16.20.0, and

CVE-2022-35255

CVE-2022-35255 describes a weakness in Node.js 18 WebCrypto key generation where EntropySource() is invoked but its return value is not checked, and the data returned may not be cryptographically strong. The underlying issue occurs in SecretKeyGenTraits::DoKeyGen() and can lead to weaker key mate...

CVE-2022-32213

CVE-2022-32213 concerns the llhttp parser in Node.js’ http module, where the parser may incorrectly parse and validate Transfer-Encoding headers, enabling HTTP Request Smuggling (HRS). The vulnerability is cited in multiple advisories (Debian, Red Hat, and Amazon Linux family) as part of a set in...

CVE-2022-32215

CVE-2022-32215 concerns the llhttp parser used by Node.js. The http module can mis-handle multi-line Transfer-Encoding headers in vulnerable builds, enabling HTTP Request Smuggling (HRS). Affected are Node.js ships with llhttp < v14.20.1, < v16.17.1, and

CVE-2022-32214

CVE-2022-32214 affects the Node.js http module via the llhttp parser, where versions <14.20.1, <16.17.1, and =14.20.1, >=16.17.1, >=18.9.1 or newer Node.js releases that bundle these llhttp versions). If exploitation details or CVSS changes are needed, refer to the linked advisories i...

CVE-2022-32222

CVE-2022-32222 affects Node.js on Linux, in the 18.x line prior to 18.40.0. The vulnerability stems from a default path for openssl.cnf that could become accessible to a non-admin user instead of /etc/ssl. The initial description does not quantify exploitation probability beyond access, but the p...

CVE-2022-32223

CVE-2022-32223 is a Node.js DLL hijacking issue on Windows. When the system has OpenSSL and an openssl.cnf at C:\Program Files\Common Files\SSL\openssl.cnf, node.exe may search for providers.dll in the user directory and via the Windows DLL search order, enabling a local attacker to place a malic...