kritisch
CVE-2021-22931
nodejs: Improper handling of untypical characters in domain names
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami, CBL-Mariner, Photon OS. Niedriger laut AlmaLinux (hoch), Oracle (hoch), Rocky Linux (hoch), Red Hat (mittel).
Beschreibung
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs, python-gevent | 0:16.14.0-1.cm2 und 1 weitere |
| Photon OS 4.0 | nodejs, nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs, nodejs:12::nodejs-devel, nodejs:12::nodejs-docs und 6 weitere | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 und 4 weitere |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs, nodejs-current | 14.17.5-r0 und 1 weitere |
| alpine 3.15 | nodejs, nodejs-current | 14.17.5-r0 und 1 weitere |
| alpine 3.16 | nodejs, nodejs-current | 14.17.5-r0 und 1 weitere |
| alpine 3.17 | nodejs, nodejs-current | 14.17.5-r0 und 1 weitere |
Alle 69 Einträge aus 22 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| bitnami::Bitnami Vulnerability Database | node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs | 0:16.14.0-1.cm2 |
| CBL-Mariner 2.0 | python-gevent | 0:21.1.2-3.cm2 |
| Photon OS 4.0 | nodejs | 14.17.5-1.ph4 |
| Photon OS 4.0 | nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs-current | 16.11.1-r0 |
| alpine 3.15 | nodejs | 14.17.5-r0 |
| alpine 3.15 | nodejs-current | 16.6.2-r0 |
| alpine 3.16 | nodejs | 14.17.5-r0 |
| alpine 3.16 | nodejs-current | 16.6.2-r0 |
| alpine 3.17 | nodejs | 14.17.5-r0 |
| alpine 3.17 | nodejs-current | 16.6.2-r0 |
| alpine 3.18 | nodejs | 14.17.5-r0 |
| alpine 3.18 | nodejs-current | 16.6.2-r0 |
| alpine 3.19 | nodejs | 14.17.5-r0 |
| alpine 3.19 | nodejs-current | 16.6.2-r0 |
| alpine 3.20 | nodejs | 14.17.5-r0 |
| alpine 3.20 | nodejs-current | 16.6.2-r0 |
| alpine 3.21 | nodejs | 14.17.5-r0 |
| alpine 3.21 | nodejs-current | 16.6.2-r0 |
| alpine 3.22 | nodejs | 14.17.5-r0 |
| alpine 3.22 | nodejs-current | 16.6.2-r0 |
| alpine 3.23 | nodejs | 14.17.5-r0 |
| alpine 3.23 | nodejs-current | 16.6.2-r0 |
| alpine 3.24 | nodejs | 14.17.5-r0 |
| alpine 3.24 | nodejs-current | 16.6.2-r0 |
| alpine edge | nodejs | 14.17.5-r0 |
| alpine edge | nodejs-current | 16.6.2-r0 |
| Oracle Linux 8 | nodejs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-devel | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-docs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.4.0+20281+eb64e322 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973 |
| rocky 8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:14::nodejs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module+el8.4.0+638+5344c6f7 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
Referenzen
- https://access.redhat.com/errata/RHSA-2021:3666
- https://access.redhat.com/security/cve/CVE-2021-22931
- https://bugzilla.redhat.com/1956818
- https://bugzilla.redhat.com/1988342
- https://bugzilla.redhat.com/1988394
- https://bugzilla.redhat.com/1990409
- https://bugzilla.redhat.com/1990415
- https://bugzilla.redhat.com/1993019
Alle 43 Referenzen
- https://bugzilla.redhat.com/1993029
- https://bugzilla.redhat.com/1993039
- https://bugzilla.redhat.com/1993924
- https://bugzilla.redhat.com/show_bug.cgi?id=1956818
- https://bugzilla.redhat.com/show_bug.cgi?id=1988342
- https://bugzilla.redhat.com/show_bug.cgi?id=1988394
- https://bugzilla.redhat.com/show_bug.cgi?id=1990409
- https://bugzilla.redhat.com/show_bug.cgi?id=1990415
- https://bugzilla.redhat.com/show_bug.cgi?id=1993019
- https://bugzilla.redhat.com/show_bug.cgi?id=1993029
- https://bugzilla.redhat.com/show_bug.cgi?id=1993039
- https://bugzilla.redhat.com/show_bug.cgi?id=1993924
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22939
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23343
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32803
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32804
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
- https://errata.almalinux.org/8/ALSA-2021-3666.html
- https://errata.rockylinux.org/RLSA-2021:3666
- https://hackerone.com/reports/1178337
- https://linux.oracle.com/cve/CVE-2021-22931.html
- https://linux.oracle.com/errata/ELSA-2021-3666.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2021-22931
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.cve.org/CVERecord?id=CVE-2021-22931
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html