Medium · published February 25, 2022
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
| Product | Versions | Fixed in |
|---|---|---|
| nodejs/node.js | < 12.22.9 | 12.22.9 |
| nodejs/node.js | ≥ 14.0.0, < 14.18.3 | 14.18.3 |
| nodejs/node.js | ≥ 16.0.0, < 16.13.2 | 16.13.2 |
| nodejs/node.js | ≥ 17.0.0, < 17.3.1 | 17.3.1 |
| oracle/graalvm | all versions | — |
| oracle/graalvm | all versions | — |
| oracle/graalvm | all versions | — |
| oracle/mysql_cluster | < 8.0.29 | 8.0.29 |
| oracle/mysql_cluster | all versions | — |
| oracle/mysql_connectors | ≤ 8.0.28 | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.29 | — |
| oracle/mysql_server | ≤ 5.7.37 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.28 | — |
| oracle/mysql_workbench | ≤ 8.0.28 | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| oracle/peoplesoft_enterprise_peopletools | all versions | — |
| debian/debian_linux | all versions | — |