Уязвимость внедрения в SAN при проверке сертификатов в Node.js
Описание
В версиях Node.js до 12.22.9, 14.18.3, 16.13.2 и 17.3.1 обнаружена уязвимость, связанная с обработкой Subject Alternative Names (SAN). При проверке сертификатов узлов против имён хостов SAN преобразовывались в строковый формат. Этот процесс был подвержен уязвимости внедрения, если в цепочке сертификатов использовались ограничения имени (name constraints), что позволяло обход этих ограничений.
В версиях Node.js с исправлением символы в SAN, вызывающие проблему, экранируются, чтобы предотвратить внедрение. Поведение может быть восстановлено с помощью командной опции --security-revert.
Затронутые версии ПО
- Node.js версии ниже 12.22.9, 14.18.3, 16.13.2 и 17.3.1
Тип уязвимости
Внедрение
Ссылки
- MitigationThird Party Advisory
- ExploitRelease NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- MitigationThird Party Advisory
- ExploitRelease NotesVendor Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Одно из
Одно из
EPSS
5.3 Medium
CVSS3
5 Medium
CVSS2
Дефекты
Связанные уязвимости
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (S ...
Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
EPSS
5.3 Medium
CVSS3
5 Medium
CVSS2