crítica
CVE-2021-22931
nodejs: Improper handling of untypical characters in domain names
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami, CBL-Mariner, Photon OS. Más baja según AlmaLinux (alta), Oracle (alta), Rocky Linux (alta), Red Hat (media).
Descripción
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs, python-gevent | 0:16.14.0-1.cm2 y 1 más |
| Photon OS 4.0 | nodejs, nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs, nodejs:12::nodejs-devel, nodejs:12::nodejs-docs y 6 más | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 y 4 más |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs, nodejs-current | 14.17.5-r0 y 1 más |
| alpine 3.15 | nodejs, nodejs-current | 14.17.5-r0 y 1 más |
| alpine 3.16 | nodejs, nodejs-current | 14.17.5-r0 y 1 más |
| alpine 3.17 | nodejs, nodejs-current | 14.17.5-r0 y 1 más |
Mostrar las 69 entradas de 22 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| bitnami::Bitnami Vulnerability Database | node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs | 0:16.14.0-1.cm2 |
| CBL-Mariner 2.0 | python-gevent | 0:21.1.2-3.cm2 |
| Photon OS 4.0 | nodejs | 14.17.5-1.ph4 |
| Photon OS 4.0 | nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs-current | 16.11.1-r0 |
| alpine 3.15 | nodejs | 14.17.5-r0 |
| alpine 3.15 | nodejs-current | 16.6.2-r0 |
| alpine 3.16 | nodejs | 14.17.5-r0 |
| alpine 3.16 | nodejs-current | 16.6.2-r0 |
| alpine 3.17 | nodejs | 14.17.5-r0 |
| alpine 3.17 | nodejs-current | 16.6.2-r0 |
| alpine 3.18 | nodejs | 14.17.5-r0 |
| alpine 3.18 | nodejs-current | 16.6.2-r0 |
| alpine 3.19 | nodejs | 14.17.5-r0 |
| alpine 3.19 | nodejs-current | 16.6.2-r0 |
| alpine 3.20 | nodejs | 14.17.5-r0 |
| alpine 3.20 | nodejs-current | 16.6.2-r0 |
| alpine 3.21 | nodejs | 14.17.5-r0 |
| alpine 3.21 | nodejs-current | 16.6.2-r0 |
| alpine 3.22 | nodejs | 14.17.5-r0 |
| alpine 3.22 | nodejs-current | 16.6.2-r0 |
| alpine 3.23 | nodejs | 14.17.5-r0 |
| alpine 3.23 | nodejs-current | 16.6.2-r0 |
| alpine 3.24 | nodejs | 14.17.5-r0 |
| alpine 3.24 | nodejs-current | 16.6.2-r0 |
| alpine edge | nodejs | 14.17.5-r0 |
| alpine edge | nodejs-current | 16.6.2-r0 |
| Oracle Linux 8 | nodejs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-devel | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-docs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.4.0+20281+eb64e322 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973 |
| rocky 8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:14::nodejs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module+el8.4.0+638+5344c6f7 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
Referencias
- https://access.redhat.com/errata/RHSA-2021:3666
- https://access.redhat.com/security/cve/CVE-2021-22931
- https://bugzilla.redhat.com/1956818
- https://bugzilla.redhat.com/1988342
- https://bugzilla.redhat.com/1988394
- https://bugzilla.redhat.com/1990409
- https://bugzilla.redhat.com/1990415
- https://bugzilla.redhat.com/1993019
Las 43 referencias
- https://bugzilla.redhat.com/1993029
- https://bugzilla.redhat.com/1993039
- https://bugzilla.redhat.com/1993924
- https://bugzilla.redhat.com/show_bug.cgi?id=1956818
- https://bugzilla.redhat.com/show_bug.cgi?id=1988342
- https://bugzilla.redhat.com/show_bug.cgi?id=1988394
- https://bugzilla.redhat.com/show_bug.cgi?id=1990409
- https://bugzilla.redhat.com/show_bug.cgi?id=1990415
- https://bugzilla.redhat.com/show_bug.cgi?id=1993019
- https://bugzilla.redhat.com/show_bug.cgi?id=1993029
- https://bugzilla.redhat.com/show_bug.cgi?id=1993039
- https://bugzilla.redhat.com/show_bug.cgi?id=1993924
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22939
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23343
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32803
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32804
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
- https://errata.almalinux.org/8/ALSA-2021-3666.html
- https://errata.rockylinux.org/RLSA-2021:3666
- https://hackerone.com/reports/1178337
- https://linux.oracle.com/cve/CVE-2021-22931.html
- https://linux.oracle.com/errata/ELSA-2021-3666.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2021-22931
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.cve.org/CVERecord?id=CVE-2021-22931
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html