medium5.3
CVE-2021-22939
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to se…
Impact
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodejs | Node.Js | from 12.0.0 before 12.22.5 from 14.0.0 before 14.17.5 from 16.0.0 before 16.6.2 |
| Oracle | Graalvm | Versions 20.3.3, 21.2.0 |
| Oracle | Jd Edwards Enterpriseone Tools | through 9.2.6.1 |
| Oracle | Mysql Cluster | through 8.0.26 |
| Oracle | Peoplesoft Enterprise Peopletools | Versions 8.57, 8.58, 8.59 |
| Netapp | Nextgen Api | All versions |
| Siemens | Sinec Infrastructure Network Services | before 1.0.1.1 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1278254
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210917-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://hackerone.com/reports/1278254
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210917-0003/
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html