CVE-2021-44533 vulnerability in nodejs and Other Products

CVE-2021-44533 vulnerability in nodejs and Other Products
Published on February 24, 2022

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Weakness Type

Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.

Products Associated with CVE-2021-44533

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2021-44533 are published in these products:

Affected Versions

Version 4.0 and below 4.* is affected.

Version 5.0 and below 5.* is affected.

Version 6.0 and below 6.* is affected.

Version 7.0 and below 7.* is affected.

Version 8.0 and below 8.* is affected.

Version 9.0 and below 9.* is affected.

Version 10.0 and below 10.* is affected.

Version 11.0 and below 11.* is affected.

Version 12.0 and below 12.22.9 is affected.

Version 13.0 and below 13.* is affected.

Version 14.0 and below 14.18.3 is affected.

Version 15.0 and below 15.* is affected.

Version 16.0 and below 16.13.2 is affected.

Version 17.0 and below 17.3.1 is affected.

Exploit Probability

EPSS

0.36%

Percentile

57.97%