Description (CNA)
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| NodeJS / Node | affected 4.0 before 4.*; affected 5.0 before 5.*; affected 6.0 before 6.*; affected 7.0 before 7.*; affected 8.0 before 8.*; affected 9.0 before 9.*; affected 10.0 before 10.*; affected 11.0 before 11.*; affected 12.0 before 12.22.5; affected 13.0 before 13.*; affected 14.0 before 14.17.5; affected 15.0 before 15.*; affected 16.0 before 16.6.2 |
CWE
CWE-295
References
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://hackerone.com/reports/1278254
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210917-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
- https://security.gentoo.org/glsa/202401-02
ADP enrichment
No English description supplied.
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://hackerone.com/reports/1278254
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://security.netapp.com/advisory/ntap-20210917-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
- https://security.gentoo.org/glsa/202401-02