Уязвимость в проверке URI SAN, позволяющая обходить ограничения имени в сертификатах
Описание
В версиях Node.js до 12.22.9, 14.18.3, 16.13.2 и 17.3.1 обнаружена уязвимость, связанная с некорректной обработкой типа Subject Alternative Name (SAN). Node.js принимал SAN типа URI, который часто не используется в определённых инфраструктурах PKI. Это могло привести к обходу промежуточных сертификатов с ограничением имени (name-constrained intermediates).
Кроме того, если протокол разрешал использование URI SAN, Node.js некорректно сопоставлял URI с именем хоста. В версиях Node.js с исправлением данная уязвимость устранена путём отключения типа URI SAN при проверке сертификатов против имени хоста. Однако поведение может быть возвращено с помощью командной опции --security-revert.
Затронутые версии ПО
- Node.js < 12.22.9
- Node.js < 14.18.3
- Node.js < 16.13.2
- Node.js < 17.3.1
Тип уязвимости
- Обход ограничений
- Некорректное сопоставление URI в сертификатах
Ссылки
- Issue TrackingMitigationPatchThird Party Advisory
- Release NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Issue TrackingMitigationPatchThird Party Advisory
- Release NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
7.4 High
CVSS3
5.8 Medium
CVSS2
Дефекты
Связанные уязвимости
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI ...
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
EPSS
7.4 High
CVSS3
5.8 Medium
CVSS2