Subject: [ASA-202110-6] nodejs-lts-erbium: multiple issues Arch Linux Security Advisory ASA-202110-6 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-22939 CVE-2021-22940 CVE-2021-22959 CVE-2021-22960 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2285 Summary ======= The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. Resolution ========== Upgrade to 12.22.7-1. # pacman -Syu "nodejs-lts-erbium>=12.22.7-1" The problems have been fixed upstream in version 12.22.7. Workaround ========== None. Description =========== - CVE-2021-22939 (certificate verification bypass) If the Node.js https API in versions before 16.6.2, 14.17.5 and 12.22.5 was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. - CVE-2021-22940 (arbitrary code execution) Node.js before versions 16.6.2, 14.17.5 and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. - CVE-2021-22959 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). - CVE-2021-22960 (url request injection) A security issue has been found in Node.js before versions 16.11.1, 14.18.1 and 12.22.7. The parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. Impact ====== Incorrect use of the https API could lead to expired certificates being accepted. Furthermore a remote attacker could execute arbitrary code or inject HTTP requests through crafted queries. References ========== https://bugs.archlinux.org/task/72412 https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939 https://hackerone.com/reports/1278254 https://github.com/nodejs-private/node-private/pull/276 https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80 https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6 https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/pull/39622 https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6 https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959 https://hackerone.com/reports/1238099 https://hackerone.com/reports/1238709 https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91 https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4 https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0 https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960 https://security.archlinux.org/CVE-2021-22939 https://security.archlinux.org/CVE-2021-22940 https://security.archlinux.org/CVE-2021-22959 https://security.archlinux.org/CVE-2021-22960