CVE-2021-44531

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "fixed": "12.22.9"
                },
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "14.18.3"
                },
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.13.2"
                },
                {
                    "introduced": "17.0.0"
                },
                {
                    "fixed": "17.3.1"
                }
            ],
            "vendor_product": "nodejs:node.js",
            "cpes": [
                "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"
            ]
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "last_affected": "8.0.29"
                }
            ],
            "vendor_product": "oracle:mysql_cluster",
            "cpes": [
                "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "last_affected": "8.0.28"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:mysql_connectors"
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "last_affected": "8.0.29"
                }
            ],
            "vendor_product": "oracle:mysql_enterprise_monitor",
            "cpes": [
                "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "last_affected": "8.0.28"
                }
            ],
            "vendor_product": "oracle:mysql_workbench",
            "cpes": [
                "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*"
            ]
        },
        {
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "introduced": "8.58"
                },
                {
                    "last_affected": "8.58"
                },
                {
                    "introduced": "8.59"
                },
                {
                    "last_affected": "8.59"
                }
            ],
            "vendor_product": "oracle:peoplesoft_enterprise_peopletools",
            "cpes": [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git / github.com/graalvm/graalvm-ce-builds

Affected ranges

Type

GIT

Repo

https://github.com/graalvm/graalvm-ce-builds

Events

Introduced

ab8db8415e996bd955acef60c0b2225761210c9a

Last affected

bd6570ec5fc8253ab93b6760c36a3883cc3bdbb2

Database specific

{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "20.3.5"
        },
        {
            "last_affected": "20.3.5"
        },
        {
            "introduced": "21.3.1"
        },
        {
            "last_affected": "21.3.1"
        },
        {
            "introduced": "22.0.0.2"
        },
        {
            "last_affected": "22.0.0.2"
        }
    ],
    "cpe": [
        "cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*"
    ]
}

Affected versions

20.*

20.3.5

21.*

21.3.1

22.*

22.0.0.2

vm-20.*

vm-20.3.5

vm-21.*

vm-21.3.1

vm-22.*

vm-22.0.0.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44531.json"

Git / github.com/mysql/mysql-server

Affected ranges

Type

GIT

Repo

https://github.com/mysql/mysql-server

Events

Introduced

Last affected

0cd98bdf981583a1cf4cb526581fc16e23bb839b

Introduced

270fd3411e3d671a73ed9725940a30080f59ce6d

Last affected

6846e6b2f72931991cc9fd589dc9946ea2ab58c9

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.7.37"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.28"
        }
    ],
    "cpe": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*"
}

Affected versions

mysql-3.*

mysql-3.23.22-beta

mysql-3.23.28-gamma

mysql-3.23.30-gamma

mysql-3.23.31

mysql-3.23.32

mysql-3.23.33

mysql-3.23.36

mysql-4.*

mysql-4.0.2

mysql-4.0.4

mysql-5.*

mysql-5.1.4

mysql-5.7.31

mysql-5.7.32

mysql-5.7.35

mysql-5.7.36

mysql-5.7.37

mysql-8.*

mysql-8.0.28

mysql-cluster-8.*

mysql-cluster-8.0.28

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44531.json"