kritik
CVE-2021-22931
nodejs: Improper handling of untypical characters in domain names
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami, CBL-Mariner, Photon OS. Daha düşük diyenler: AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Red Hat (orta).
Açıklama
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node, node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs, python-gevent | 0:16.14.0-1.cm2 ve 1 tane daha |
| Photon OS 4.0 | nodejs, nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs, nodejs:12::nodejs-devel, nodejs:12::nodejs-docs ve 6 tane daha | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 ve 4 tane daha |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs, nodejs-current | 14.17.5-r0 ve 1 tane daha |
| alpine 3.15 | nodejs, nodejs-current | 14.17.5-r0 ve 1 tane daha |
| alpine 3.16 | nodejs, nodejs-current | 14.17.5-r0 ve 1 tane daha |
| alpine 3.17 | nodejs, nodejs-current | 14.17.5-r0 ve 1 tane daha |
22 kaynaktaki 69 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | node | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| bitnami::Bitnami Vulnerability Database | node-min | 12.12.1, 12.22.5, 14.14.1, 14.17.5, 16.6.2 |
| CBL-Mariner 1.0 | nodejs | 0:14.17.5-1.cm1 |
| CBL-Mariner 2.0 | nodejs | 0:16.14.0-1.cm2 |
| CBL-Mariner 2.0 | python-gevent | 0:21.1.2-3.cm2 |
| Photon OS 4.0 | nodejs | 14.17.5-1.ph4 |
| Photon OS 4.0 | nodejs-devel | 14.17.5-1.ph4 |
| alma 8 | nodejs:12::nodejs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7 |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alpine 3.11 | nodejs | 12.22.5-r0 |
| alpine 3.12 | nodejs | 12.22.5-r0 |
| alpine 3.13 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs | 14.17.5-r0 |
| alpine 3.14 | nodejs-current | 16.11.1-r0 |
| alpine 3.15 | nodejs | 14.17.5-r0 |
| alpine 3.15 | nodejs-current | 16.6.2-r0 |
| alpine 3.16 | nodejs | 14.17.5-r0 |
| alpine 3.16 | nodejs-current | 16.6.2-r0 |
| alpine 3.17 | nodejs | 14.17.5-r0 |
| alpine 3.17 | nodejs-current | 16.6.2-r0 |
| alpine 3.18 | nodejs | 14.17.5-r0 |
| alpine 3.18 | nodejs-current | 16.6.2-r0 |
| alpine 3.19 | nodejs | 14.17.5-r0 |
| alpine 3.19 | nodejs-current | 16.6.2-r0 |
| alpine 3.20 | nodejs | 14.17.5-r0 |
| alpine 3.20 | nodejs-current | 16.6.2-r0 |
| alpine 3.21 | nodejs | 14.17.5-r0 |
| alpine 3.21 | nodejs-current | 16.6.2-r0 |
| alpine 3.22 | nodejs | 14.17.5-r0 |
| alpine 3.22 | nodejs-current | 16.6.2-r0 |
| alpine 3.23 | nodejs | 14.17.5-r0 |
| alpine 3.23 | nodejs-current | 16.6.2-r0 |
| alpine 3.24 | nodejs | 14.17.5-r0 |
| alpine 3.24 | nodejs-current | 16.6.2-r0 |
| alpine edge | nodejs | 14.17.5-r0 |
| alpine edge | nodejs-current | 16.6.2-r0 |
| Oracle Linux 8 | nodejs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-devel | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-docs | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+20313+f90c2973 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.4.0+20281+eb64e322 |
| Oracle Linux 8 | nodejs-packaging | 23-3.module+el8.3.0+7818+6cd30d85 |
| Oracle Linux 8 | npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+20313+f90c2973 |
| rocky 8 | nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-devel | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-docs | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-full-i18n | 1:12.22.5-1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:12::npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
| rocky 8 | nodejs:14::nodejs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.17.5-1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.3-1.module+el8.4.0+638+5344c6f7 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::npm | 1:6.14.14-1.14.17.5.1.module+el8.4.0+654+17ff1d38 |
| rocky 8 | npm | 1:6.14.14-1.12.22.5.1.module+el8.4.0+647+e905fa21 |
Referanslar
- https://access.redhat.com/errata/RHSA-2021:3666
- https://access.redhat.com/security/cve/CVE-2021-22931
- https://bugzilla.redhat.com/1956818
- https://bugzilla.redhat.com/1988342
- https://bugzilla.redhat.com/1988394
- https://bugzilla.redhat.com/1990409
- https://bugzilla.redhat.com/1990415
- https://bugzilla.redhat.com/1993019
43 referansın hepsi
- https://bugzilla.redhat.com/1993029
- https://bugzilla.redhat.com/1993039
- https://bugzilla.redhat.com/1993924
- https://bugzilla.redhat.com/show_bug.cgi?id=1956818
- https://bugzilla.redhat.com/show_bug.cgi?id=1988342
- https://bugzilla.redhat.com/show_bug.cgi?id=1988394
- https://bugzilla.redhat.com/show_bug.cgi?id=1990409
- https://bugzilla.redhat.com/show_bug.cgi?id=1990415
- https://bugzilla.redhat.com/show_bug.cgi?id=1993019
- https://bugzilla.redhat.com/show_bug.cgi?id=1993029
- https://bugzilla.redhat.com/show_bug.cgi?id=1993039
- https://bugzilla.redhat.com/show_bug.cgi?id=1993924
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22931
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22939
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22940
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23343
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32803
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32804
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3672
- https://errata.almalinux.org/8/ALSA-2021-3666.html
- https://errata.rockylinux.org/RLSA-2021:3666
- https://hackerone.com/reports/1178337
- https://linux.oracle.com/cve/CVE-2021-22931.html
- https://linux.oracle.com/errata/ELSA-2021-3666.html
- https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/
- https://nvd.nist.gov/vuln/detail/CVE-2021-22931
- https://security.gentoo.org/glsa/202401-02
- https://security.netapp.com/advisory/ntap-20210923-0001/
- https://security.netapp.com/advisory/ntap-20211022-0003/
- https://www.cve.org/CVERecord?id=CVE-2021-22931
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpuoct2021.html