Bug 2105424 (CVE-2022-32222)

Summary:	CVE-2022-32222 nodejs: potential openssl.cnf hijack
Product:	[Other] Security Response	Reporter:	Sage McTaggart <amctagga>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	hhorak, jorton, jstanek, mrunge, mvanderw, nodejs-maint, nodejs-sig, security-response-team, sgallagh, thrcka, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs 18.5.0	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in NodeJS. The issue occurs when Node.js starts on Linux based systems and attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily does not exist. This flaw allows an attacker on some shared systems to create this file and affect the default OpenSSL configuration for other users.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-08-31 16:25:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2108469, 2108480
Bug Blocks:	2105423

Description Sage McTaggart 2022-07-08 18:44:01 UTC

CVE-2022-32222

When Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily doesn't exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users.

Thank you to Michael Scovetta from the OpenSSF Alpha-Omega project for reporting this vulnerability.

Impacts:

Node.js 18.x

Comment 2 TEJ RATHI 2022-07-19 07:45:09 UTC

Created nodejs:18/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2108480]

Comment 7 Product Security DevOps Team 2022-08-31 16:25:49 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-32222