Bug 2040846 (CVE-2021-44532) - CVE-2021-44532 nodejs: Certificate Verification Bypass via String Injection
Summary: CVE-2021-44532 nodejs: Certificate Verification Bypass via String Injection
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-44532
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat2042977 Red Hat2042978 Red Hat2042981 2052252 Red Hat2150317 2040847 2040848 2040849 2040850 2040851 Red Hat2042979 Red Hat2042980 Red Hat2042983 Red Hat2046354 Red Hat2046369 Red Hat2086804 Red Hat2086805 Red Hat2086806 Red Hat2086807 Red Hat2087167 Red Hat2132707 Red Hat2132708 Red Hat2150316
Blocks: Embargoed2040868
TreeView+ depends on / blocked
 
Reported: 2022-01-14 19:34 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-04-12 14:58 UTC (History)
24 users (show)

Fixed In Version: node 12.22.9, node 14.18.3, node 16.13.2, node 17.3.1
Doc Type: If docs needed, set a value
Doc Text:
It was found that node.js did not safely read the x509 certificate generalName format properly, resulting in data injection. A certificate could use a specially crafted extension in order to be successfully validated, permitting an attacker to impersonate a trusted host.
Clone Of:
Environment:
Last Closed: 2022-06-06 12:47:54 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:4914 0 None None None 2022-06-06 09:27:13 UTC
Red Hat Product Errata RHSA-2022:7044 0 None None None 2022-10-19 10:09:56 UTC
Red Hat Product Errata RHSA-2022:7830 0 None None None 2022-11-08 11:33:16 UTC
Red Hat Product Errata RHSA-2022:9073 0 None None None 2022-12-15 16:16:37 UTC
Red Hat Product Errata RHSA-2023:1742 0 None None None 2023-04-12 14:58:14 UTC

Description Guilherme de Almeida Suckevicz 2022-01-14 19:34:20 UTC 
Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.

Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection.

Reference:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
Comment 1 Guilherme de Almeida Suckevicz 2022-01-14 19:35:09 UTC 
Created nodejs tracking bugs for this issue:

Affects: epel-7 [bug 2040851]
Affects: fedora-all [bug 2040848]


Created nodejs:12/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2040847]


Created nodejs:14/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2040849]


Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2040850]
Comment 2 Cedric Buissart 2022-01-20 12:53:47 UTC 
Upstream fix :
https://github.com/nodejs/node/commit/466e5415a2b7b3574ab5403acb87e89a94a980d1
Comment 7 errata-xmlrpc 2022-06-06 09:27:10 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2022:4914 https://access.redhat.com/errata/RHSA-2022:4914
Comment 8 Product Security DevOps Team 2022-06-06 12:47:51 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-44532
Comment 10 errata-xmlrpc 2022-10-19 10:09:53 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2022:7044 https://access.redhat.com/errata/RHSA-2022:7044
Comment 11 errata-xmlrpc 2022-11-08 11:33:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7830 https://access.redhat.com/errata/RHSA-2022:7830
Comment 12 errata-xmlrpc 2022-12-15 16:16:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:9073 https://access.redhat.com/errata/RHSA-2022:9073
Comment 13 errata-xmlrpc 2023-04-12 14:58:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742
Note You need to log in before you can comment on or make changes to this bug.