CVE-2021-22939

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Link	Resource
https://hackerone.com/reports/1278254	Exploit Issue Tracking
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/	Patch Vendor Advisory
https://security.netapp.com/advisory/ntap-20210917-0003/	Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	Patch Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf	Patch Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html	Issue Tracking Third Party Advisory

Configuration 1

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:* cpe:2.3:a:oracle:mysql_cluster:*:*:*:*:*:*:*:* cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* cpe:2.3:a:netapp:nextgen_api:-:*:*:*:*:*:*:* cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

---

Published : 2021-08-16 07:15

Updated : 2022-11-07 06:32

---

NVD link : CVE-2021-22939

Mitre link : CVE-2021-22939

No products.

CWE-295

Improper Certificate Validation