Information Disclosure

🗓️ 10 Jul 2021 13:46:13Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 29 Views

Node.js vulnerable out-of-bounds read in libuv's idna_toascii() functio

Reporter	Title	Published	Views	Family All 237
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud Pak for Automation	2 Oct 202100:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	30 Sep 202115:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM App Connect Enterprise v11 & v12 (CVE-2021-22918 and CVE-2021-22921)	1 Oct 202111:17	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-23362, CVE-2021-22918)	22 Apr 202214:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to multiple security vulnerabilities due to its use of NodeJS (CVE-2021-22918, CVE-2021-22960, CVE-2021-22959)	15 Jul 202215:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities	15 Oct 202113:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to denial of service due to CVE-2021-22918	20 Oct 202110:08	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services	9 Nov 202118:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm

Vulners

Node

AND

libuv1 libuv1Match1.40.0-1debian

debian debian_linuxMatch11

AND

libuv1 libuv1Match1.40.0-1debian

debian debian_linuxMatch999

AND

nodejs nodejsMatch12.15.0-r1os

nodejs nodejsMatch12.22.1-r0os

nodejs nodejsMatch12.21.0-r0os

alpinelinux alpine_linuxMatch3.11

AND

nodejs nodejsMatch12.17.0-r0os

nodejs nodejsMatch12.21.0-r0os

nodejs nodejsMatch12.22.1-r0os

nodejs nodejsMatch12.16.3-r0os

alpinelinux alpine_linuxMatch3.12

AND

nodejs nodejsMatch14.17.0-r0os

nodejs nodejsMatch14.17.1-r0os

alpinelinux alpine_linuxMatch3.14

AND

nodejs nodejsMatch14.16.1-r1os

nodejs nodejsMatch14.16.0-r0os

alpinelinux alpine_linuxMatch3.13

AND

devel develMatch1.38.0-2ubuntu1debian

devel develMatch1.40.0-1debian

debian debian_linux

AND

apache groovyMatch1.38.0-2ubuntu2debian

apache groovyMatch1.38.0-2ubuntu1debian

debian debian_linux

AND

focal focalMatch1.34.2-1ubuntu1debian

focal focalMatch1.34.2-1ubuntu1.1debian

debian debian_linux

rh-nodejs12-nodejs rh-nodejs12-nodejsMatch12.14.1_1.el7

rh-nodejs12-nodejs rh-nodejs12-nodejsMatch12.10.0_4.el7

libuv libuvMatch1.34.2_1.module_el8+8340+1d027fbb

libuv libuvMatch1.38.0_2.module_el8+9059+ed0b6bfa

libuv libuvMatch1.34.2_1.module_el8+7524+ef0ea62e

libuv libuvMatch1.38.0_2.module_el8+9071+b2b61c14

libuv libuvMatch1.36.0_3.module_el8+8692+52300fb6

libuv libuvMatch1.38.1_1.module_el8+9376+ad948c7e

libuv libuvMatch1.23.1_2.module_el8+8698+518af944

libuv libuvMatch1.23.1_1.el8

libuv libuvMatch1.23.1_1.module_el8+8246+46ee4016

libuv libuvMatch1.38.0_2.el8

libuv libuvMatch1.40.0_1.el8

libuv libuvMatch1.38.0_1.el8

Source	Link
security-tracker	www.security-tracker.debian.org/tracker/CVE-2021-22918
security	www.security.gentoo.org/glsa/202401-23
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
hackerone	www.hackerone.com/reports/1209681
nodejs	www.nodejs.org/en/blog/vulnerability/july-2021-security-releases/
security	www.security.netapp.com/advisory/ntap-20210805-0003/

16 Jan 2024 15:27Current

1.5Low risk

Vulners AI Score1.5

CVSS 25

CVSS 3.15.3

EPSS0.23132