CVE-2021-44532 (CNNVD-202201-728)
中文标题:
nodejs 信任管理问题漏洞
英文标题:
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a...
漏洞描述
中文描述:
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。 nodejs 中存在信任管理问题漏洞，目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
英文描述:
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| NodeJS | Node | - | < 4.* | - |
cpe:2.3:a:nodejs:node:*:*:*:*:*:*:*:*
|
| nodejs | node.js | * | - | - |
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
|
| oracle | graalvm | 20.3.5 | - | - |
cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*
|
| oracle | graalvm | 21.3.1 | - | - |
cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*
|
| oracle | graalvm | 22.0.0.2 | - | - |
cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*
|
| oracle | mysql_cluster | * | - | - |
cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*
|
| oracle | mysql_connectors | * | - | - |
cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
|
| oracle | mysql_enterprise_monitor | * | - | - |
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
|
| oracle | mysql_server | * | - | - |
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
|
| oracle | mysql_workbench | * | - | - |
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
|
| oracle | peoplesoft_enterprise_peopletools | 8.58 | - | - |
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
|
| oracle | peoplesoft_enterprise_peopletools | 8.59 | - | - |
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
|
| debian | debian_linux | 11.0 | - | - |
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2021-44532 |
2025-11-11 15:21:09 | 2025-11-11 07:37:06 |
| NVD | nvd_CVE-2021-44532 |
2025-11-11 14:57:49 | 2025-11-11 07:45:24 |
| CNNVD | cnnvd_CNNVD-202201-728 |
2025-11-11 15:10:48 | 2025-11-11 07:57:07 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 信任管理问题
- cnnvd_id: 未提取 -> CNNVD-202201-728
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 5.3
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 14 -> 13
- data_sources: ['cve'] -> ['cve', 'nvd']