CVE-2021-44533

MEDIUM

5.3

CVSS Score

Published: February 24, 2022 at 06:27 PM UTC

Updated: October 8, 2026 at 10:17 PM UTC

9 products affected across 3 vendorsDebian LinuxMySQL ServerPeopleSoft Enterprise PeopleTools

Using Node by NodeJS?

Get instant alerts when new vulnerabilities affect Node - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 9%

SSVC

No known exploit

Description

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

11.0

Node.js · Node.js

95%

v < 12.22.914.0.0 ≤ v < 14.18.316.0.0 ≤ v < 16.13.217.0.0 ≤ v < 17.3.1*10.0 11.0 12.0 13.0 14.0 15.0 16.0 17.0 4.0 5.0 6.0 7.0 8.0 9.0

Affected range stops below 10.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.22.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.18.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.13.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.3.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 5.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 6.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.*, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.*, so it looks safe — our inference, not a vendor statement

GraalVM · Oracle

95%

20.3.5 21.3.1 22.0.0.2

MySQL Cluster · Oracle

95%

v < 8.0.29*8.0.29

Affected range stops below 8.0.29, so it looks safe — our inference, not a vendor statement

MySQL Connectors · Oracle

95%

v ≤ 8.0.28*

MySQL Enterprise Monitor · Oracledrupal

95%

v ≤ 8.0.29*

MySQL Server · Oraclenpm

95%

v ≤ 5.7.378.0.0 ≤ v ≤ 8.0.28*

MySQL Workbench · Oracle

95%

v ≤ 8.0.28*

PeopleSoft Enterprise PeopleTools · Oracledrupal

95%

8.58 8.59

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (6)

x_refsource_MISCExploitMitigationThird Party Advisory

Source: [email protected]

https://hackerone.com/reports/1429694

x_refsource_MISCRelease NotesVendor Advisory

Source: [email protected]

https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://security.netapp.com/advisory/ntap-20220325-0007/

Vendor Advisoryx_refsource_DEBIANThird Party Advisory

Source: [email protected]

https://www.debian.org/security/2022/dsa-5170

x_refsource_MISCPatchThird Party Advisory

Source: [email protected]

https://www.oracle.com/security-alerts/cpuapr2022.html

x_refsource_MISCThird Party Advisory

Source: [email protected]

https://www.oracle.com/security-alerts/cpujul2022.html

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card