Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

An update of the nodejs package has been released.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the nodejs-16.16.0-1.el9 build changelog.

  - Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through     log files. The CLI supports URLs like     <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted     and is printed to stdout and also to any generated log files. (CVE-2020-15095)

  - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application     crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns     library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection     vulnerabilities in applications using the library. (CVE-2021-22931)

  - If the Node.js https API was used incorrectly and undefined was in passed for the rejectUnauthorized     parameter, no error was returned and connections to servers with an expired certificate would have been     accepted. (CVE-2021-22939)

  - Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker     might be able to exploit the memory corruption, to change process behavior. (CVE-2021-22940)

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a     denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of     service. This issue only affects consumers using the strict option. (CVE-2021-27290)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency     information in package-lock.json differs from package.json. This behavior is inconsistent with the     documentation, and makes it easier for attackers to install malware that was supposed to have been blocked     by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a     vulnerability. It would require someone to socially engineer package.json which has different dependencies     than package-lock.json. That user would have to have file system or write access to change dependencies.
    The npm team states preventing malicious actors from socially engineering or gaining file system access is     outside the scope of the npm CLI. (CVE-2021-43616)

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse     and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use     the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32214)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1742 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

    Security Fix(es):

    * decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

    * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

    * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

    * minimist: prototype pollution (CVE-2021-44906)

    * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-084 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - ** DISPUTED ** The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if     dependency information in package-lock.json differs from package.json. This behavior is inconsistent with     the documentation, and makes it easier for attackers to install malware that was supposed to have been     blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is     not a vulnerability. It would require someone to socially engineer package.json which has different     dependencies than package-lock.json. That user would have to have file system or write access to change     dependencies. The npm team states preventing malicious actors from socially engineering or gaining file     system access is outside the scope of the npm CLI. (CVE-2021-43616)

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse     and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use     the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32214)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

  - A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which     allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin     user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. (CVE-2022-32222)

  - Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows     platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows     machine:* OpenSSL has been installed and C:\Program Files\Common Files\SSL\openssl.cnf exists.Whenever     the above conditions are present, `node.exe` will search for `providers.dll` in the current user     directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in     Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of     paths and exploit this vulnerability. (CVE-2022-32223)

  - A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with     EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems     with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can     (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically     strong and therefore not suitable as keying material. (CVE-2022-35255)

  - The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not     terminated with CLRF. This may result in HTTP Request Smuggling. (CVE-2022-35256)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. (CVE-2022-3786)

  - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due     to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly     check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this     issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is     to complete the fix. (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:9073 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).

    Security Fix(es):

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

    * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

    * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

    * minimist: prototype pollution (CVE-2021-44906)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [rhel-8] (BZ#2151625)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:9073 advisory.

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:9073 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of     Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of     Service. (CVE-2022-3517)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

  - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due     to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly     check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this     issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is     to complete the fix. (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-90731 advisory.

    - Record CVE references already addressed in this or previous upstream versions       Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:9073 advisory.

  - nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

  - nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

  - nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

  - minimist: prototype pollution (CVE-2021-44906)

  - nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

  - nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

  - nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nodejs installed on the remote host is prior to 18.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-214 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - ** DISPUTED ** The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if     dependency information in package-lock.json differs from package.json. This behavior is inconsistent with     the documentation, and makes it easier for attackers to install malware that was supposed to have been     blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is     not a vulnerability. It would require someone to socially engineer package.json which has different     dependencies than package-lock.json. That user would have to have file system or write access to change     dependencies. The npm team states preventing malicious actors from socially engineering or gaining file     system access is outside the scope of the npm CLI. (CVE-2021-43616)

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7830 advisory.

    - Record issues fixed in the current version       Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824       Resolves: CVE-2022-0235
    - Rebase to version 14.20.1       Resolves: CVE-2022-35256

    nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7830 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

  - nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:7830 advisory.

  - nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

  - nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

  - nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

  - nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

  - nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7830 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

    * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

    * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7044 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

    * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

    * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

    * minimist: prototype pollution (CVE-2021-44906)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

  - The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template     injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and     overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template     compilation). (CVE-2022-29078)

  - The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address     string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control     that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
    (CVE-2021-29418)

  - Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated     remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A     remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical     VPN or LAN hosts. (CVE-2021-28918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5170 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4914 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.22.12). This     is the last planned rebase before the collection reaches End of Life.

    Security Fix(es):

    * nodejs-json-schema: Prototype pollution vulnerability (CVE-2021-3918)

    * nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links     allowing arbitrary file creation and overwrite (CVE-2021-37701)

    * nodejs-tar: Insufficient symlink protection due to directory cache poisoning using symbolic links     allowing arbitrary file creation and overwrite (CVE-2021-37712)

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

    * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

    * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

    * minimist: prototype pollution (CVE-2021-44906)

    * llhttp: HTTP Request Smuggling due to spaces in headers (CVE-2021-22959)

    * llhttp: HTTP Request Smuggling when parsing the body of chunked requests (CVE-2021-22960)

    * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 12.22.9, 14.18.3, 16.13.2, 17.3.1. It is, therefore, affected by multiple vulnerabilities as referenced in the January 10th 2022 Security Releases advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN     types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did     not match the URI correctly. (CVE-2021-44531)

  - Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer     certificates against hostnames when validating connections. The string format was subject to an injection     vulnerability when name constraints were used within a certificate chain, allowing the bypass of these     name constraints. (CVE-2021-44532)

  - Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft     certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a     multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow     bypassing the certificate subject verification. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled input     to be passed to the properties parameter while simultaneously passing a plain object with at least one     property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.
    (CVE-2022-21824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0113-1 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN     types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did     not match the URI correctly. (CVE-2021-44531)

  - Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer     certificates against hostnames when validating connections. The string format was subject to an injection     vulnerability when name constraints were used within a certificate chain, allowing the bypass of these     name constraints. (CVE-2021-44532)

  - Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft     certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a     multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow     bypassing the certificate subject verification. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled input     to be passed to the properties parameter while simultaneously passing a plain object with at least one     property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.
    (CVE-2022-21824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0112-1 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN     types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did     not match the URI correctly. (CVE-2021-44531)

  - Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer     certificates against hostnames when validating connections. The string format was subject to an injection     vulnerability when name constraints were used within a certificate chain, allowing the bypass of these     name constraints. (CVE-2021-44532)

  - Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft     certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a     multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow     bypassing the certificate subject verification. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled input     to be passed to the properties parameter while simultaneously passing a plain object with at least one     property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.
    (CVE-2022-21824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0113-1 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0112-1 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0101-1 advisory.

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - The npm package tar (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     the same name as the directory, where the symlink and directory names in the archive entry used     backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/`     characters as path separators, however `\` is a valid filename character on posix systems. By first     creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass     node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an     arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary     file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive     filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`,     then on case-insensitive file systems, the creation of the symbolic link would remove the directory from     the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A     subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link,     thinking that the directory had already been created. These issues were addressed in releases 4.4.16,     5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these     issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar.
    If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc. (CVE-2021-37701)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by     ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat     calls to determine whether a given path is a directory, paths are cached when directories are created.
    This logic was insufficient when extracting tar files that contained both a directory and a symlink with     names containing unicode values that normalized to the same value. Additionally, on Windows systems, long     path portions would resolve to the same file system entities as their 8.3 short path counterparts. A     specially crafted tar archive could thus include a directory with one form of the path, followed by a     symbolic link with a different string that resolves to the same file system entity, followed by a file     using the first form. By first creating a directory, and then replacing that directory with a symlink that     had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to     bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into     an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing     arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9.
    The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are     still using a v3 release we recommend you update to a more recent version of node-tar. If this is not     possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p. (CVE-2021-37712)

  - The npm package tar (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file     creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file     whose location would be outside of the extraction target directory is not extracted. This is, in part,     accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that     contain `..` path portions, and resolving the sanitized paths against the extraction target directory.
    This logic was insufficient on Windows systems when extracting tar files that contained a path that was     not an absolute path, but specified a drive letter different from the extraction target, such as     `C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`,     then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current     working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..`     portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not     properly sanitized by the logic that checked for `..` within the normalized and split portions of the     path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases     4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for     these issues. If you are still using a v3 release we recommend you update to a more recent version of     node-tar. There is no reasonable way to work around this issue without performing the same path     normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched     versions of node-tar, rather than attempt to sanitize paths themselves. (CVE-2021-37713)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is, in     part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies     with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies     differ only in the case of their name, Arborist's internal data structure saw them as separate items that     could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file     systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as     `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be     written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in     their `package.json` file such as `foo: file:/some/path`. Another package, `pwn-b` could define a     dependency such as `FOO: file:foo.tgz`. On case-insensitive file systems, if `pwn-a` was installed, and     then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any     existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-     insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is     included in npm v7.20.7 and above. (CVE-2021-39134)

  - `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder     hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be     met, and the extraction of package contents will always be performed into the expected folder. This is     accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`     folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could     allow Arborist to write package dependencies to any arbitrary location on the file system. Note that     symbolic links contained within package artifact contents are filtered out, so another means of creating a     `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace     `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could     supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the     root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making     changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist     2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see     the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0114-1 advisory.

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203365	Photon OS 4.0: Nodejs PHSA-2022-4.0-0164	Nessus	PhotonOS Local Security Checks	high
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
191380	CentOS 9 : nodejs-16.16.0-1.el9	Nessus	CentOS Local Security Checks	critical
174178	RHEL 8 : nodejs:14 (RHSA-2023:1742)	Nessus	Red Hat Local Security Checks	critical
173113	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2023-084)	Nessus	Amazon Linux Local Security Checks	critical
168922	RHEL 8 : nodejs:16 (RHSA-2022:9073)	Nessus	Red Hat Local Security Checks	critical
168884	Rocky Linux 8 : nodejs:16 (RLSA-2022:9073)	Nessus	Rocky Linux Local Security Checks	critical
168871	AlmaLinux 8 : nodejs:16 (ALSA-2022:9073)	Nessus	Alma Linux Local Security Checks	critical
168852	Oracle Linux 8 : ELSA-2022-9073-1: / nodejs:16 (ELSA-2022-90731)	Nessus	Oracle Linux Local Security Checks	critical
168832	CentOS 8 : nodejs:16 (CESA-2022:9073)	Nessus	CentOS Local Security Checks	critical
168555	Amazon Linux 2022 : nodejs (ALAS2022-2022-214)	Nessus	Amazon Linux Local Security Checks	critical
167552	Oracle Linux 8 : nodejs:14 (ELSA-2022-7830)	Nessus	Oracle Linux Local Security Checks	high
167288	AlmaLinux 8 : nodejs:14 (ALSA-2022:7830)	Nessus	Alma Linux Local Security Checks	high
167121	CentOS 8 : nodejs:14 (CESA-2022:7830)	Nessus	CentOS Local Security Checks	high
167078	RHEL 8 : nodejs:14 (RHSA-2022:7830)	Nessus	Red Hat Local Security Checks	high
166263	RHEL 7 : rh-nodejs14-nodejs (RHSA-2022:7044)	Nessus	Red Hat Local Security Checks	critical
164652	IBM Cognos Analytics Multiple Vulnerabilities (6616285)	Nessus	CGI abuses	critical
162561	Debian DSA-5170-1 : nodejs - security update	Nessus	Debian Local Security Checks	high
161897	RHEL 7 : rh-nodejs12-nodejs (RHSA-2022:4914)	Nessus	Red Hat Local Security Checks	critical
157354	Node.js 12.x < 12.22.9 / 14.x < 14.18.3 / 16.x < 16.13.2 / 17.x < 17.3.1 Multiple Vulnerabilities (January 10th 2022 Security Releases).	Nessus	Misc.	high
156851	openSUSE 15 Security Update : nodejs12 (openSUSE-SU-2022:0113-1)	Nessus	SuSE Local Security Checks	high
156849	openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2022:0112-1)	Nessus	SuSE Local Security Checks	high
156817	SUSE SLES15 Security Update : nodejs12 (SUSE-SU-2022:0113-1)	Nessus	SuSE Local Security Checks	high
156809	SUSE SLES15 Security Update : nodejs14 (SUSE-SU-2022:0112-1)	Nessus	SuSE Local Security Checks	high
156806	SUSE SLES12 Security Update : nodejs12 (SUSE-SU-2022:0101-1)	Nessus	SuSE Local Security Checks	high
156805	SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2022:0114-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-44533

medium

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

high

critical

critical

high

critical

high

high

high

high

high

high

high