BIT-node-2021-22939
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/node/BIT-node-2021-22939.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-node-2021-22939
- Aliases
- Published
- 2024-03-06T11:06:17.760Z
- Modified
- 2024-12-16T15:27:09.124903Z
- Summary
- [none]
- Details
-
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
- Database specific
{ "cpes": [ "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*" ], "severity": "Medium" }- References
-
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1278254
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210917-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Affected packages
Bitnami / node
Package
- Name
- node
- Purl
- pkg:bitnami/node
Severity
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator