Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
Created nodejs tracking bugs for this issue:
Affects: epel-7 [bug 2040861]
Affects: fedora-all [bug 2040857]
Created nodejs:12/nodejs tracking bugs for this issue:
Affects: fedora-all [bug 2040858]
Created nodejs:14/nodejs tracking bugs for this issue:
Affects: fedora-all [bug 2040859]
Created nodejs:16/nodejs tracking bugs for this issue:
Affects: fedora-all [bug 2040860]
Upstream fix :
This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 7
Via RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):