ByteOS Network

NVD Vulnerability Details :

CVE-2021-22939

Modified

Source-support@hackerone.com

Published At-16 Aug, 2021 | 19:15

Updated At-05 Jan, 2024 | 10:15

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:N/I:P/A:N

CPE Matches

Node.js (OpenJS Foundation)

>>node.js>>Versions from 12.0.0(inclusive) to 12.22.5(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 14.0.0(inclusive) to 14.17.5(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Node.js (OpenJS Foundation)

>>node.js>>Versions from 16.0.0(inclusive) to 16.6.2(exclusive)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Oracle Corporation

>>graalvm>>20.3.3

cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*

Oracle Corporation

>>graalvm>>21.2.0

cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*

Oracle Corporation

>>jd_edwards_enterpriseone_tools>>Versions up to 9.2.6.1(inclusive)

cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*

Oracle Corporation

>>mysql_cluster>>Versions up to 8.0.26(inclusive)

cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*

Oracle Corporation

>>peoplesoft_enterprise_peopletools>>8.57

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*

Oracle Corporation

>>peoplesoft_enterprise_peopletools>>8.58

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

Oracle Corporation

>>peoplesoft_enterprise_peopletools>>8.59

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

NetApp, Inc.

>>nextgen_api>>-

cpe:2.3:a:netapp:nextgen_api:-:*:*:*:*:*:*:*

Siemens AG

>>sinec_infrastructure_network_services>>Versions before 1.0.1.1(exclusive)

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>10.0

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-295	Primary	nvd@nist.gov
CWE-295	Secondary	support@hackerone.com

CWE ID: CWE-295

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-295

Type: Secondary

Source: support@hackerone.com

References

Hyperlink	Source	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	support@hackerone.com	Patch Third Party Advisory
https://hackerone.com/reports/1278254	support@hackerone.com	Exploit Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html	support@hackerone.com	Issue Tracking Third Party Advisory
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/	support@hackerone.com	Patch Vendor Advisory
https://security.gentoo.org/glsa/202401-02	support@hackerone.com	N/A
https://security.netapp.com/advisory/ntap-20210917-0003/	support@hackerone.com	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	support@hackerone.com	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	support@hackerone.com	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	support@hackerone.com	Patch Third Party Advisory