Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
Created nodejs tracking bugs for this issue:
Affects: epel-7 [bug 2040861]
Affects: fedora-all [bug 2040857]
Created nodejs:12/nodejs tracking bugs for this issue:
Affects: fedora-all [bug 2040858]
Created nodejs:14/nodejs tracking bugs for this issue:
Affects: fedora-all [bug 2040859]
Created nodejs:16/nodejs tracking bugs for this issue:
Affects: fedora-all [bug 2040860]
Upstream fix :