Vulnerability Name:

CVE-2021-22940 (CCN-207520)

Assigned:2021-07-29
Published:2021-07-29
Updated:2022-11-03
Summary:Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-416
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2021-22940

Source: CONFIRM
Type: Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Source: XF
Type: UNKNOWN
nodejs-cve202122940-sec-bypass(207520)

Source: MISC
Type: Permissions Required, Third Party Advisory
https://hackerone.com/reports/1238162

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20221005 [SECURITY] [DLA 3137-1] nodejs security update

Source: CCN
Type: Node.js Blog, 2021-08-11
Use after free on close http2 on stream canceling (High) (CVE-2021-22940)

Source: MISC
Type: Patch, Vendor Advisory
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210923-0001/

Source: CCN
Type: IBM Security Bulletin 6492199 (Watson Discovery)
IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js

Source: CCN
Type: IBM Security Bulletin 6493269 (Business Automation Workflow)
Security vulnerabilities in IBM SDK for Node.js might affect the configuration editor used by IBM Business Automation Workflow and IBM Business Process Manager (BPM)

Source: CCN
Type: IBM Security Bulletin 6493863 (Cloud Transformation Advisor)
IBM Cloud Transformation Advisor is affected by multiple Node.js vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6495861 (Event Streams)
IBM Event Streams UI affected by multiple node package vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6507031 (App Connect Enterprise Certified Container)
IBM App Connect Enterprise Certified Container may be vulnerable to memory corruption due to CVE-2021-22940

Source: CCN
Type: IBM Security Bulletin 6507409 (Voice Gateway)
Multiple security vulnerabilities in Node.js affect IBM Voice Gateway

Source: CCN
Type: IBM Security Bulletin 6507665 (Cloud Pak for Integration)
IBM Cloud Pak for Integration is vulnerable to multiple Node.js vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6509088 (InfoSphere Information Server)
IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js

Source: CCN
Type: IBM Security Bulletin 6514821 (Cloud Pak for Multicloud Management)
A security vulnerability in Node.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Services

Source: CCN
Type: IBM Security Bulletin 6517022 (Observability with Instana (OnPrem))
Vulnerabilitiy affects IBM Observability with Instana

Source: CCN
Type: IBM Security Bulletin 6524930 (Spectrum Control)
Vulnerabilities in Node.js, IBM WebSphere Application Server Liberty, and OpenSSL affect IBM Spectrum Control

Source: CCN
Type: IBM Security Bulletin 6525034 (Spectrum Protect Plus)
Vulnerabilities in Node.js, Color-String, and PostgreSQL affect IBM Spectrum Protect Plus

Source: CCN
Type: IBM Security Bulletin 6541298 (Cloud Pak for Automation)
Multiple security vulnerabilities fixed in Cloud Pak for Automation components

Source: CCN
Type: IBM Security Bulletin 6551876 (Cloud Pak for Security)
Cloud Pak for Security uses packages that are vulnerable to multiple CVEs

Source: CCN
Type: IBM Security Bulletin 6570957 (Cognos Analytics)
IBM Cognos Analytics has addressed multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6573633 (QRadar Use Case Manager)
IBM QRadar Use Case Manager app is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6590981 (QRadar Data Synchronization App)
IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6602551 (Security Verify Governance)
IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html

Source: N/A
Type: Patch, Third Party Advisory
N/A

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 12.0.0 and < 12.22.5)
  • OR cpe:/a:nodejs:node.js:*:*:*:*:lts:*:*:* (Version >= 14.0.0 and < 14.17.5)
  • OR cpe:/a:nodejs:node.js:*:*:*:*:-:*:*:* (Version >= 16.0.0 and < 16.6.2)

    • Configuration 2:
  • cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*
  • OR cpe:/a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* (Version <= 9.2.6.1)

    • Configuration 3:
  • cpe:/a:netapp:nextgen_api:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* (Version < 1.0.1.1)

    • Configuration 5:
  • cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nodejs:node.js:12:*:*:*:*:*:*:*
  • OR cpe:/a:nodejs:node.js:14.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:business_process_manager:8.5:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_process_manager:8.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.4:*:standard:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.5:*:standard:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.3.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:app_connect_enterprise_certified_container:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:2019.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:spectrum_control:5.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:voice_gateway:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:watson_discovery:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_automation:21.0.2:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:event_streams:10.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.1.7:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_governance:10.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8162
    P
    		Security update for terraform-provider-helm (Important)
    2023-06-21
    oval:org.opensuse.security:def:8186
    P
    		Security update for cloud-init (Important) (in QA)
    2023-06-12
    oval:org.opensuse.security:def:8165
    P
    		Security update for mariadb (Low)
    2023-06-09
    oval:org.opensuse.security:def:8184
    P
    		Security update for google-cloud-sap-agent (Important)
    2023-06-07
    oval:org.opensuse.security:def:119471
    P
    		Security update for nodejs10 (Important)
    2022-08-19
    oval:org.opensuse.security:def:118795
    P
    		Security update for nodejs10 (Important)
    2022-08-19
    oval:org.opensuse.security:def:119656
    P
    		Security update for nodejs10 (Important)
    2022-08-19
    oval:org.opensuse.security:def:118985
    P
    		Security update for nodejs10 (Important)
    2022-08-19
    oval:org.opensuse.security:def:701
    P
    		Security update for nodejs10 (Important)
    2022-08-19
    oval:org.opensuse.security:def:119290
    P
    		Security update for nodejs10 (Important)
    2022-08-19
    oval:org.opensuse.security:def:3542
    P
    		lcms2-2.7-9.7.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95172
    P
    		nodejs16-16.14.1-150400.1.26 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:113037
    P
    		nodejs14-14.17.5-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113039
    P
    		nodejs16-16.6.2-2.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106478
    P
    		nodejs14-14.17.5-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:106479
    P
    		nodejs16-16.6.2-2.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:111072
    P
    		Security update for nodejs14 (Important)
    2021-09-28
    oval:com.redhat.rhsa:def:20213666
    P
    		RHSA-2021:3666: nodejs:14 security and bug fix update (Important)
    2021-09-27
    oval:org.opensuse.security:def:69254
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:111727
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:96130
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:109486
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:102269
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:69275
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:102820
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:1709
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:118582
    P
    		Security update for nodejs14 (Important)
    2021-09-23
    oval:org.opensuse.security:def:49452
    P
    		Security update for nodejs14 (Important)
    2021-09-22
    oval:org.opensuse.security:def:20981
    P
    		Security update for nodejs14 (Important)
    2021-09-22
    oval:com.redhat.rhsa:def:20213623
    P
    		RHSA-2021:3623: nodejs:12 security and bug fix update (Important)
    2021-09-21
    oval:org.opensuse.security:def:111040
    P
    		Security update for nodejs12 (Important)
    2021-08-31
    oval:org.opensuse.security:def:69273
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:102817
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:1707
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:118579
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:69251
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:111695
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:96127
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:109483
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:102267
    P
    		Security update for nodejs12 (Important)
    2021-08-30
    oval:org.opensuse.security:def:49449
    P
    		Security update for nodejs12 (Important)
    2021-08-24
    oval:org.opensuse.security:def:20978
    P
    		Security update for nodejs12 (Important)
    2021-08-24
    BACK
    nodejs node.js *
    nodejs node.js *
    nodejs node.js *
    oracle peoplesoft enterprise peopletools 8.57
    oracle peoplesoft enterprise peopletools 8.58
    oracle peoplesoft enterprise peopletools 8.59
    oracle graalvm 20.3.3
    oracle graalvm 21.2.0
    oracle jd edwards enterpriseone tools *
    netapp nextgen api -
    siemens sinec infrastructure network services *
    debian debian linux 10.0
    nodejs node.js 12
    nodejs node.js 14.0
    ibm business process manager 8.5
    ibm business process manager 8.6
    ibm infosphere information server 11.7
    ibm business automation workflow 18.0.0.0
    ibm business automation workflow 18.0.0.1
    ibm business automation workflow 18.0.0.2
    ibm business automation workflow 19.0.0.1
    ibm business automation workflow 19.0.0.2
    ibm spectrum control 5.3.1
    ibm spectrum control 5.3.2
    ibm spectrum control 5.3.3
    ibm spectrum control 5.3.0.1
    ibm watson discovery 2.0.0
    ibm business automation workflow 19.0.0.3
    ibm event streams 2019.4.1
    ibm event streams 2019.4.2
    ibm event streams 10.0.0
    ibm spectrum control 5.3.4
    ibm spectrum control 5.3.5
    ibm spectrum control 5.3.6
    ibm spectrum control 5.3.7
    ibm app connect enterprise certified container 1.0.0
    ibm app connect enterprise certified container 1.0.1
    ibm app connect enterprise certified container 1.0.2
    ibm app connect enterprise certified container 1.0.3
    ibm app connect enterprise certified container 1.0.4
    ibm business automation workflow 20.0.0.1
    ibm event streams 2019.4.3
    ibm event streams 10.1.0
    ibm business automation workflow 20.0.0.2
    ibm spectrum control 5.4.1
    ibm voice gateway 1.0.7
    ibm watson discovery 2.2.1
    ibm event streams 10.2.0
    ibm cloud pak for automation 21.0.1
    ibm cloud pak for automation 21.0.2 -
    ibm business automation workflow 21.0.2
    ibm cloud pak for security 1.7.2.0
    ibm event streams 10.3.0
    ibm event streams 10.3.1
    ibm cognos analytics 11.2.0
    ibm cognos analytics 11.1.7
    ibm cognos analytics 11.2.1
    ibm security verify governance 10.0