CVE-2021-44531

HIGH

7.4

CVSS Score

Published: February 24, 2022 at 06:27 PM UTC

Updated: June 17, 2026 at 04:12 AM UTC

8 products affected across 2 vendorsMySQL ServerPeopleSoft Enterprise PeopleToolsNode.js

Using Node by NodeJS?

Get instant alerts when new vulnerabilities affect Node - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.4

Exploit prediction

EPSS 8%

Description

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Node.js · Node.js

95%

v < 12.22.910.0 ≤ v < 10.*11.0 ≤ v < 11.*12.0 ≤ v < 12.22.913.0 ≤ v < 13.*14.0 ≤ v < 14.18.314.0.0 ≤ v < 14.18.315.0 ≤ v < 15.*16.0 ≤ v < 16.13.216.0.0 ≤ v < 16.13.217.0 ≤ v < 17.3.117.0.0 ≤ v < 17.3.14.0 ≤ v < 4.*5.0 ≤ v < 5.*6.0 ≤ v < 6.*7.0 ≤ v < 7.*8.0 ≤ v < 8.*9.0 ≤ v < 9.*10.0 11.0 12.0 13.0 14.0 15.0 16.0 17.0 4.0 5.0 6.0 7.0 8.0 9.0

Affected range stops below 10.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.22.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.18.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.13.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.*, so it looks safe — our inference, not a vendor statement

GraalVM · Oracle

95%

20.3.5 21.3.1 22.0.0.2

MySQL Cluster · Oracle

95%

v ≤ 8.0.29

MySQL Connectors · Oracle

95%

v ≤ 8.0.28

MySQL Enterprise Monitor · Oracledrupal

95%

v ≤ 8.0.29

MySQL Server · Oraclenpm

95%

v ≤ 5.7.378.0.0 ≤ v ≤ 8.0.28

MySQL Workbench · Oracle

95%

v ≤ 8.0.28

PeopleSoft Enterprise PeopleTools · Oracledrupal

95%

8.58 8.59

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (6)

x_refsource_MISCIssue TrackingMitigationPatchThird Party Advisory

Source: [email protected]

https://hackerone.com/reports/1429694

x_refsource_MISCRelease NotesVendor Advisory

Source: [email protected]

https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://security.netapp.com/advisory/ntap-20220325-0007/

Vendor Advisoryx_refsource_DEBIANThird Party Advisory

Source: [email protected]

https://www.debian.org/security/2022/dsa-5170

x_refsource_MISCPatchThird Party Advisory

Source: [email protected]

https://www.oracle.com/security-alerts/cpuapr2022.html

x_refsource_MISCThird Party Advisory

Source: [email protected]

https://www.oracle.com/security-alerts/cpujul2022.html

CVSS

7.4HIGH[email protected]

Attack Vector: NETWORK
Complexity: HIGH
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card