CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
84.6%
Severity: High
Date : 2021-10-21
CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960
Package : nodejs-lts-fermium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-2284
The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable
to multiple issues including arbitrary code execution, url request
injection and certificate verification bypass.
Upgrade to 14.18.1-1.
The problems have been fixed upstream in version 14.18.1.
None.
If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5
was used incorrectly and “undefined” was in passed for the
“rejectUnauthorized” parameter, no error was returned and connections
to servers with an expired certificate would have been accepted.
Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a
use after free attack where an attacker might be able to exploit memory
corruption to change process behavior. The issue is a follow on to
CVE-2021-22930 as the issue was not completely resolved in the fix for
CVE-2021-22930.
A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The http parser accepts requests with a space (SP)
right after the header name before the colon. This can lead to HTTP
Request Smuggling (HRS).
A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing
the body of chunked requests. This leads to HTTP Request Smuggling
(HRS) under certain conditions.
Incorrect use of the https API could lead to expired certificates being
accepted. Furthermore a remote attacker could execute arbitrary code or
inject HTTP requests through crafted queries.
https://bugs.archlinux.org/task/72413
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939
https://hackerone.com/reports/1278254
https://github.com/nodejs-private/node-private/pull/276
https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80
https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6
https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940
https://github.com/nodejs/node/pull/39423
https://github.com/nodejs/node/pull/39622
https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6
https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
https://hackerone.com/reports/1238099
https://hackerone.com/reports/1238709
https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
https://security.archlinux.org/CVE-2021-22939
https://security.archlinux.org/CVE-2021-22940
https://security.archlinux.org/CVE-2021-22959
https://security.archlinux.org/CVE-2021-22960
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | nodejs-lts-fermium | < 14.18.1-1 | UNKNOWN |
bugs.archlinux.org/task/72413
github.com/nodejs-private/node-private/pull/276
github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d
github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b
github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6
github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80
github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6
github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
github.com/nodejs/node/pull/39423
github.com/nodejs/node/pull/39622
hackerone.com/reports/1238099
hackerone.com/reports/1238709
hackerone.com/reports/1278254
nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939
nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940
nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
security.archlinux.org/AVG-2284
security.archlinux.org/CVE-2021-22939
security.archlinux.org/CVE-2021-22940
security.archlinux.org/CVE-2021-22959
security.archlinux.org/CVE-2021-22960
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
84.6%