Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly

Overview

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Affected

• node.js < 12.22.9
• node.js >= 14.0.0, < 14.18.3
• node.js >= 16.0.0, < 16.13.2
• node.js >= 17.0.0, < 17.3.1
• graalvm = 20.3.5
• graalvm = 21.3.1
• graalvm = 22.0.0.2
• mysql_cluster < 8.0.29
• mysql_cluster = 8.0.29
• mysql_connectors <= 8.0.28
• mysql_enterprise_monitor <= 8.0.29
• mysql_server <= 5.7.37
• mysql_server >= 8.0.0, <= 8.0.28
• mysql_workbench <= 8.0.28
• peoplesoft_enterprise_peopletools = 8.58
• peoplesoft_enterprise_peopletools = 8.59
• debian_linux = 11.0

Remediation

Upgrade past the affected range:

• node.js 17.3.1
• mysql_cluster 8.0.29