critique
CVE-2021-22931
nodejs: Improper handling of untypical characters in domain names
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Bitnami, CBL-Mariner, Photon OS. Plus basse selon AlmaLinux (élevée), Oracle (élevée), Rocky Linux (élevée), Red Hat (moyenne).
Description
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs, python-gevent | 0:16.14.0-1.cm2 et 1 autres |
| Photon OS 4.0 | nodejs, nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs, nodejs:12::nodejs-devel, nodejs:12::nodejs-docs et 6 autres | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 et 4 autres |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs, nodejs-current | 14.17.5-r0 et 1 autres |
| alpine 3.15 | nodejs, nodejs-current | 14.17.5-r0 et 1 autres |
| alpine 3.16 | nodejs, nodejs-current | 14.17.5-r0 et 1 autres |
| alpine 3.17 | nodejs, nodejs-current | 14.17.5-r0 et 1 autres |
Afficher les 69 entrées de 22 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| bitnami::Bitnami Vulnerability Database | node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs | 0:16.14.0-1.cm2 |
| CBL-Mariner 2.0 | python-gevent | 0:21.1.2-3.cm2 |
| Photon OS 4.0 | nodejs | 14.17.5-1.ph4 |
| Photon OS 4.0 | nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs-current | 16.11.1-r0 |
| alpine 3.15 | nodejs | 14.17.5-r0 |
| alpine 3.15 | nodejs-current | 16.6.2-r0 |
| alpine 3.16 | nodejs | 14.17.5-r0 |
| alpine 3.16 | nodejs-current | 16.6.2-r0 |
| alpine 3.17 | nodejs | 14.17.5-r0 |
| alpine 3.17 | nodejs-current | 16.6.2-r0 |
| alpine 3.18 | nodejs | 14.17.5-r0 |
| alpine 3.18 | nodejs-current | 16.6.2-r0 |
| alpine 3.19 | nodejs | 14.17.5-r0 |
| alpine 3.19 | nodejs-current | 16.6.2-r0 |
| alpine 3.20 | nodejs | 14.17.5-r0 |
| alpine 3.20 | nodejs-current | 16.6.2-r0 |
| alpine 3.21 | nodejs | 14.17.5-r0 |
| alpine 3.21 | nodejs-current | 16.6.2-r0 |
| alpine 3.22 | nodejs | 14.17.5-r0 |
| alpine 3.22 | nodejs-current | 16.6.2-r0 |
| alpine 3.23 | nodejs | 14.17.5-r0 |
| alpine 3.23 | nodejs-current | 16.6.2-r0 |
| alpine 3.24 | nodejs | 14.17.5-r0 |
| alpine 3.24 | nodejs-current | 16.6.2-r0 |
| alpine edge | nodejs | 14.17.5-r0 |
| alpine edge | nodejs-current | 16.6.2-r0 |
| Oracle Linux 8 | nodejs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-devel | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-docs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.4.0+20281+eb64e322 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973 |
| rocky 8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:14::nodejs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module+el8.4.0+638+5344c6f7 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
Références
- https://access.redhat.com/errata/RHSA-2021:3666
- https://access.redhat.com/security/cve/CVE-2021-22931
- https://bugzilla.redhat.com/1956818
- https://bugzilla.redhat.com/1988342
- https://bugzilla.redhat.com/1988394
- https://bugzilla.redhat.com/1990409
- https://bugzilla.redhat.com/1990415
- https://bugzilla.redhat.com/1993019
Les 43 références
- https://bugzilla.redhat.com/1993029
- https://bugzilla.redhat.com/1993039
- https://bugzilla.redhat.com/1993924
- https://bugzilla.redhat.com/show_bug.cgi?id=1956818
- https://bugzilla.redhat.com/show_bug.cgi?id=1988342
- https://bugzilla.redhat.com/show_bug.cgi?id=1988394
- https://bugzilla.redhat.com/show_bug.cgi?id=1990409
- https://bugzilla.redhat.com/show_bug.cgi?id=1990415
- https://bugzilla.redhat.com/show_bug.cgi?id=1993019
- https://bugzilla.redhat.com/show_bug.cgi?id=1993029
- https://bugzilla.redhat.com/show_bug.cgi?id=1993039
- https://bugzilla.redhat.com/show_bug.cgi?id=1993924
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22939
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23343
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32803
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32804
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
- https://errata.almalinux.org/8/ALSA-2021-3666.html
- https://errata.rockylinux.org/RLSA-2021:3666
- https://hackerone.com/reports/1178337
- https://linux.oracle.com/cve/CVE-2021-22931.html
- https://linux.oracle.com/errata/ELSA-2021-3666.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2021-22931
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.cve.org/CVERecord?id=CVE-2021-22931
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html