CVEvulnerability
CVE-2021-22939
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-08-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-295
Description
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
Affected configurations
• nodejs node.js (>= 12.0.0 < 12.22.5)
• nodejs node.js (>= 14.0.0 < 14.17.5)
• nodejs node.js (>= 16.0.0 < 16.6.2)
• oracle graalvm 20.3.3
• oracle graalvm 21.2.0
• oracle jd edwards enterpriseone tools (<= 9.2.6.1)
• oracle mysql cluster (<= 8.0.26)
• oracle peoplesoft enterprise peopletools 8.57
• oracle peoplesoft enterprise peopletools 8.58
• oracle peoplesoft enterprise peopletools 8.59
• netapp nextgen api
• siemens sinec infrastructure network services (< 1.0.1.1)
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://hackerone.com/reports/1278254 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html Issue Tracking, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202401-02 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20210917-0003/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://hackerone.com/reports/1278254 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html Issue Tracking, Third Party Advisory
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/ Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202401-02 security.gentoo.org
- https://security.netapp.com/advisory/ntap-20210917-0003/ Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory