Vulnerability CVE-2021-22939 - CERT Civis.Net

Vulnerability Name:

CVE-2021-22939 (CCN-207233)

Assigned:

2021-08-11

Published:

2021-08-11

Updated:

2022-11-07

Summary:

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

CVSS v3 Severity:

5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
3.2 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

3.7 Low (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
3.2 Low (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2021-22939

Source: CONFIRM
Type: Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: XF
Type: UNKNOWN
nodejs-cve202122939-sec-bypass(207233)

Source: MISC
Type: Exploit, Issue Tracking, Third Party Advisory
https://hackerone.com/reports/1278254

Source: MLIST
Type: Issue Tracking, Third Party Advisory
[debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security update

Source: CCN
Type: Node.js Blog, 2021-08-11
Node v16.6.2 (Current)

Source: MISC
Type: Patch, Vendor Advisory
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210917-0003/

Source: CCN
Type: IBM Security Bulletin 6492199 (Watson Discovery)
IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Source: CCN
Type: IBM Security Bulletin 6493269 (Business Automation Workflow)
Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Source: CCN
Type: IBM Security Bulletin 6493863 (Cloud Transformation Advisor)
IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6495861 (Event Streams)
IBM Event Streams UI affected by multiple node package vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6507023 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container may be vulnerable to trusting expired certificates due to CVE-2021-22939

Source: CCN
Type: IBM Security Bulletin 6507095 (Planning Analytics)
IBM Planning Analytics Workspace is affected by security vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6507665 (Cloud Pak for Integration)
IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6509088 (InfoSphere Information Server)
IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js

Source: CCN
Type: IBM Security Bulletin 6514799 (Cloud Pak for Multicloud Management)
A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services

Source: CCN
Type: IBM Security Bulletin 6524930 (Spectrum Control)
Vulnerabilities in Node.js, IBM WebSphere Application Server Liberty, and OpenSSL affect IBM Spectrum Control

Source: CCN
Type: IBM Security Bulletin 6525034 (Spectrum Protect Plus)
Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus

Source: CCN
Type: IBM Security Bulletin 6541298 (Cloud Pak for Automation)
Multiple security vulnerabilities fixed in Cloud Pak for Automation components

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Source: CCN
Type: IBM Security Bulletin 6570957 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6573307 (Security Guardium Insights)
IBM Security Guardium Insights is affected by Node.js vulnerability (CVE-2021-22939)

Source: CCN
Type: IBM Security Bulletin 6573633 (QRadar Use Case Manager)
IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6590981 (QRadar Data Synchronization App)
IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6602551 (Security Verify Governance)
IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js

Source: CCN
Type: IBM Security Bulletin 6855777 (Engineering Requirements Quality Assistant On-Premises)
There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2021-22939, CVE-2021-22931, CVE-2020-7598)

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Source: N/A
Type: Patch, Third Party Advisory
N/A

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerable Configuration:

Configuration 1:

cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 12.0.0 and < 12.22.5)

OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 14.0.0 and < 14.17.5)

OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version >= 16.0.0 and < 16.6.2)

Configuration 2:

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

OR cpe:/a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*

OR cpe:/a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*

OR cpe:/a:oracle:mysql_cluster:*:*:*:*:*:*:*:* (Version <= 8.0.26)

OR cpe:/a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* (Version <= 9.2.6.1)

Configuration 3:

cpe:/a:netapp:nextgen_api:-:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* (Version < 1.0.1.1)

Configuration 5:

cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

Configuration CCN 1:

cpe:/a:nodejs:node.js:12:*:*:*:*:*:*:*

OR cpe:/a:nodejs:node.js:14.0:*:*:*:*:*:*:*

AND

cpe:/a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:watson_discovery:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:2019.4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:2019.4.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:10.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.4:*:standard:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.5:*:standard:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.3.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:2019.4.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:10.1.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_control:5.4.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:watson_discovery:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:10.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:*

OR cpe:/a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:10.3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:event_streams:10.3.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*

OR cpe:/a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_verify_governance:10.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:engineering_requirements_quality_assistant_on-premises:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:8162	P	Security update for terraform-provider-helm (Important)	2023-06-21
oval:org.opensuse.security:def:8186	P	Security update for cloud-init (Important) (in QA)	2023-06-12
oval:org.opensuse.security:def:8165	P	Security update for mariadb (Low)	2023-06-09
oval:org.opensuse.security:def:8184	P	Security update for google-cloud-sap-agent (Important)	2023-06-07
oval:org.opensuse.security:def:8163	P	Security update for tiff (Moderate)	2023-05-31
oval:org.opensuse.security:def:3542	P	lcms2-2.7-9.7.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:95172	P	nodejs16-16.14.1-150400.1.26 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:6165	P	Security update for tiff (Important)	2022-02-18
oval:org.opensuse.security:def:113039	P	nodejs16-16.6.2-2.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:113037	P	nodejs14-14.17.5-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:106478	P	nodejs14-14.17.5-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:106479	P	nodejs16-16.6.2-2.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:111072	P	Security update for nodejs14 (Important)	2021-09-28
oval:com.redhat.rhsa:def:20213666	P	RHSA-2021:3666: nodejs:14 security and bug fix update (Important)	2021-09-27
oval:org.opensuse.security:def:109486	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:102820	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:1709	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:96130	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:69275	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:118582	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:111727	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:102269	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:69254	P	Security update for nodejs14 (Important)	2021-09-23
oval:org.opensuse.security:def:49452	P	Security update for nodejs14 (Important)	2021-09-22
oval:org.opensuse.security:def:20981	P	Security update for nodejs14 (Important)	2021-09-22
oval:com.redhat.rhsa:def:20213623	P	RHSA-2021:3623: nodejs:12 security and bug fix update (Important)	2021-09-21
oval:org.opensuse.security:def:111050	P	Security update for nodejs10 (Moderate)	2021-09-07
oval:org.opensuse.security:def:118580	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:111704	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:69252	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:109484	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:102818	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:76322	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:96128	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:67254	P	Security update for nodejs10 (Moderate)	2021-09-03
oval:org.opensuse.security:def:111040	P	Security update for nodejs12 (Important)	2021-08-31
oval:org.opensuse.security:def:118579	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:111695	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:69273	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:69251	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:102267	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:109483	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:102817	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:96127	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:1707	P	Security update for nodejs12 (Important)	2021-08-30
oval:org.opensuse.security:def:49448	P	Security update for nodejs10 (Moderate)	2021-08-24
oval:org.opensuse.security:def:20977	P	Security update for nodejs10 (Moderate)	2021-08-24
oval:org.opensuse.security:def:49449	P	Security update for nodejs12 (Important)	2021-08-24
oval:org.opensuse.security:def:20978	P	Security update for nodejs12 (Important)	2021-08-24