CVE-2021-44533

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-44533
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44533.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-44533
Aliases
Downstream
Related
Published
2022-02-24T19:15:09.407Z
Modified
2026-07-10T12:00:51.559927552Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Database specific 
{
    "unresolved_ranges": [
        {
            "vendor_product": "nodejs:node.js",
            "extracted_events": [
                {
                    "fixed": "12.22.9"
                },
                {
                    "introduced": "14.0.0"
                },
                {
                    "fixed": "14.18.3"
                },
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.13.2"
                },
                {
                    "introduced": "17.0.0"
                },
                {
                    "fixed": "17.3.1"
                }
            ],
            "cpes": [
                "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"
            ],
            "source": "CPE_RANGE"
        },
        {
            "vendor_product": "oracle:mysql_cluster",
            "extracted_events": [
                {
                    "fixed": "8.0.29"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE"
        },
        {
            "vendor_product": "oracle:mysql_connectors",
            "extracted_events": [
                {
                    "last_affected": "8.0.28"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE"
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "last_affected": "8.0.29"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:mysql_enterprise_monitor"
        },
        {
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "last_affected": "8.0.28"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "oracle:mysql_workbench"
        },
        {
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "11.0"
                },
                {
                    "last_affected": "11.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "oracle:mysql_cluster",
            "extracted_events": [
                {
                    "introduced": "8.0.29"
                },
                {
                    "last_affected": "8.0.29"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:mysql_cluster:8.0.29:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING"
        },
        {
            "vendor_product": "oracle:peoplesoft_enterprise_peopletools",
            "extracted_events": [
                {
                    "introduced": "8.58"
                },
                {
                    "last_affected": "8.58"
                },
                {
                    "introduced": "8.59"
                },
                {
                    "last_affected": "8.59"
                }
            ],
            "cpes": [
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/graalvm/graalvm-ce-builds

Affected ranges

Type
GIT
Repo
https://github.com/graalvm/graalvm-ce-builds
Events
Introduced
ab8db8415e996bd955acef60c0b2225761210c9a
Last affected
bd6570ec5fc8253ab93b6760c36a3883cc3bdbb2
Database specific 
{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "20.3.5"
        },
        {
            "last_affected": "20.3.5"
        },
        {
            "introduced": "21.3.1"
        },
        {
            "last_affected": "21.3.1"
        },
        {
            "introduced": "22.0.0.2"
        },
        {
            "last_affected": "22.0.0.2"
        }
    ],
    "cpe": [
        "cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*"
    ]
}

Affected versions

20.*
20.3.5
21.*
21.3.1
22.*
22.0.0.2
vm-20.*
vm-20.3.5
vm-21.*
vm-21.3.1
vm-22.*
vm-22.0.0.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44533.json"

Git / github.com/mysql/mysql-server

Affected ranges

Type
GIT
Repo
https://github.com/mysql/mysql-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0cd98bdf981583a1cf4cb526581fc16e23bb839b
Introduced
270fd3411e3d671a73ed9725940a30080f59ce6d
Last affected
6846e6b2f72931991cc9fd589dc9946ea2ab58c9
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.7.37"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.28"
        }
    ],
    "cpe": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*"
}

Affected versions

mysql-3.*
mysql-3.23.22-beta
mysql-3.23.28-gamma
mysql-3.23.30-gamma
mysql-3.23.31
mysql-3.23.32
mysql-3.23.33
mysql-3.23.36
mysql-4.*
mysql-4.0.2
mysql-4.0.4
mysql-5.*
mysql-5.1.4
mysql-5.7.31
mysql-5.7.32
mysql-5.7.35
mysql-5.7.36
mysql-5.7.37
mysql-8.*
mysql-8.0.28
mysql-cluster-8.*
mysql-cluster-8.0.28

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-44533.json"