Subject: [ASA-202110-5] nodejs-lts-fermium: multiple issues

Arch Linux Security Advisory ASA-202110-5
=========================================

Severity: High
Date    : 2021-10-21
CVE-ID  : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960
Package : nodejs-lts-fermium
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2284

Summary
=======

The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable
to multiple issues including arbitrary code execution, url request
injection and certificate verification bypass.

Resolution
==========

Upgrade to 14.18.1-1.

# pacman -Syu "nodejs-lts-fermium>=14.18.1-1"

The problems have been fixed upstream in version 14.18.1.

Workaround
==========

None.

Description
===========

- CVE-2021-22939 (certificate verification bypass)

If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5
was used incorrectly and "undefined" was in passed for the
"rejectUnauthorized" parameter, no error was returned and connections
to servers with an expired certificate would have been accepted.

- CVE-2021-22940 (arbitrary code execution)

Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a
use after free attack where an attacker might be able to exploit memory
corruption to change process behavior. The issue is a follow on to
CVE-2021-22930 as the issue was not completely resolved in the fix for
CVE-2021-22930.

- CVE-2021-22959 (url request injection)

A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The http parser accepts requests with a space (SP)
right after the header name before the colon. This can lead to HTTP
Request Smuggling (HRS).

- CVE-2021-22960 (url request injection)

A security issue has been found in Node.js before versions 16.11.1,
14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing
the body of chunked requests. This leads to HTTP Request Smuggling
(HRS) under certain conditions.

Impact
======

Incorrect use of the https API could lead to expired certificates being
accepted. Furthermore a remote attacker could execute arbitrary code or
inject HTTP requests through crafted queries.

References
==========

https://bugs.archlinux.org/task/72413
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939
https://hackerone.com/reports/1278254
https://github.com/nodejs-private/node-private/pull/276
https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80
https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6
https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940
https://github.com/nodejs/node/pull/39423
https://github.com/nodejs/node/pull/39622
https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6
https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
https://hackerone.com/reports/1238099
https://hackerone.com/reports/1238709
https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
https://security.archlinux.org/CVE-2021-22939
https://security.archlinux.org/CVE-2021-22940
https://security.archlinux.org/CVE-2021-22959
https://security.archlinux.org/CVE-2021-22960