CVE-2021-44533: node.js before 12.22.9 (exclusive), from 14.0.0 (inclusive), before 14.18.3 (exclusive), from 16.0.0 (inclusive)…

Affected technology

node.js · before 12.22.9 (exclusive)
nodejs

node.js · from 14.0.0 (inclusive), before 14.18.3 (exclusive)
nodejs

node.js · from 16.0.0 (inclusive), before 16.13.2 (exclusive)
nodejs

node.js · from 17.0.0 (inclusive), before 17.3.1 (exclusive)
nodejs

graalvm · 20.3.5
oracle

graalvm · 21.3.1
oracle

graalvm · 22.0.0.2
oracle

mysql cluster · before 8.0.29 (exclusive)
oracle

mysql cluster · 8.0.29
oracle

mysql connectors · through 8.0.28 (inclusive)
oracle

mysql enterprise monitor · through 8.0.29 (inclusive)
oracle

mysql server · through 5.7.37 (inclusive)
oracle

mysql server · from 8.0.0 (inclusive), through 8.0.28 (inclusive)
oracle

mysql workbench · through 8.0.28 (inclusive)
oracle

peoplesoft enterprise peopletools · 8.58
oracle

peoplesoft enterprise peopletools · 8.59
oracle

debian linux · 11.0
debian

Node · 4.0 to before 4.*, 5.0 to before 5.*, 6.0 to before 6.*, 7.0 to before 7.*, 8.0 to before 8.*, 9.0 to before 9.*, 10.0 to before 10.*, 11.0 to before 11.*, 12.0 to before 12.22.9, 13.0 to before 13.*, 14.0 to before 14.18.3, 15.0 to before 15.*, 16.0 to before 16.13.2, 17.0 to before 17.3.1
NodeJS

Component: Not specified by the source

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. NVD’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low.