ByteOS Network

▼CVE Numbering Authority (CNA)

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Affected Products

Vendor

Node.js (OpenJS Foundation)

Product

Node

Default Status

unaffected

Versions

Affected

From 4.0 before 4.* (semver)
From 5.0 before 5.* (semver)
From 6.0 before 6.* (semver)
From 7.0 before 7.* (semver)
From 8.0 before 8.* (semver)
From 9.0 before 9.* (semver)
From 10.0 before 10.* (semver)
From 11.0 before 11.* (semver)
From 12.0 before 12.22.5 (semver)
From 13.0 before 13.* (semver)
From 14.0 before 14.17.5 (semver)
From 15.0 before 15.* (semver)
From 16.0 before 16.6.2 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-295	Improper Certificate Validation (CWE-295)

Type: CWE

CWE ID: CWE-295

Description: Improper Certificate Validation (CWE-295)

References

Hyperlink	Resource
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/	N/A
https://hackerone.com/reports/1278254	N/A
https://www.oracle.com/security-alerts/cpuoct2021.html	N/A
https://security.netapp.com/advisory/ntap-20210917-0003/	N/A
https://www.oracle.com/security-alerts/cpujan2022.html	N/A
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	N/A
https://www.oracle.com/security-alerts/cpujul2022.html	N/A
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html	mailing-list
https://security.gentoo.org/glsa/202401-02	vendor-advisory

Hyperlink: https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/

Resource: N/A

Hyperlink: https://hackerone.com/reports/1278254

Resource: N/A

Hyperlink: https://www.oracle.com/security-alerts/cpuoct2021.html

Resource: N/A

Hyperlink: https://security.netapp.com/advisory/ntap-20210917-0003/

Resource: N/A

Hyperlink: https://www.oracle.com/security-alerts/cpujan2022.html

Resource: N/A

Hyperlink: https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Resource: N/A

Hyperlink: https://www.oracle.com/security-alerts/cpujul2022.html

Resource: N/A

Hyperlink: https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html

Resource:

mailing-list

Hyperlink: https://security.gentoo.org/glsa/202401-02

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/	x_transferred
https://hackerone.com/reports/1278254	x_transferred
https://www.oracle.com/security-alerts/cpuoct2021.html	x_transferred
https://security.netapp.com/advisory/ntap-20210917-0003/	x_transferred
https://www.oracle.com/security-alerts/cpujan2022.html	x_transferred
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	x_transferred
https://www.oracle.com/security-alerts/cpujul2022.html	x_transferred
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html	mailing-list x_transferred
https://security.gentoo.org/glsa/202401-02	vendor-advisory x_transferred