CVE-2021-22939

Fixed in a distro release EPSS 15%

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.

Published 2021-08-16 · CVE record · OSV

Products: NodeJS Node

Distro releases

Release	Package	Fixed in
AlmaLinux:8	nodejs	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
AlmaLinux:8	nodejs	1:12.22.5-1.module_el8.5.0+85+79a7b441
AlmaLinux:8	nodejs-devel	1:12.22.5-1.module_el8.5.0+85+79a7b441
AlmaLinux:8	nodejs-devel	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
AlmaLinux:8	nodejs-docs	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
AlmaLinux:8	nodejs-full-i18n	1:12.22.5-1.module_el8.5.0+85+79a7b441
AlmaLinux:8	nodejs-full-i18n	1:12.22.5-1.module_el8.4.0+2529+af52a4c7
AlmaLinux:8	nodejs-nodemon	2.0.3-1.module_el8.4.0+2521+c668cc9f
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2224+b07ac28e
AlmaLinux:8	nodejs-packaging	17-3.module_el8.4.0+2521+c668cc9f
AlmaLinux:8	nodejs-packaging	17-3.module_el8.3.0+2023+d2377ea3
AlmaLinux:8	nodejs-packaging	23-3.module_el8.5.0+254+b4526b16
AlmaLinux:8	nodejs-packaging	23-3.module_el8.4.0+2522+3bd42762
AlmaLinux:8	npm	1:6.14.14-1.12.22.5.1.module_el8.4.0+2529+af52a4c7
AlmaLinux:8	npm	1:6.14.14-1.12.22.5.1.module_el8.5.0+85+79a7b441
Alpine:v3.11	nodejs	12.22.5-r0
Alpine:v3.12	nodejs	12.22.5-r0
Alpine:v3.13	nodejs	14.17.5-r0
Alpine:v3.14	nodejs	14.17.5-r0
Alpine:v3.15	nodejs	14.17.5-r0
Alpine:v3.16	nodejs	14.17.5-r0
Alpine:v3.17	nodejs	14.17.5-r0
Alpine:v3.18	nodejs	14.17.5-r0
Alpine:v3.19	nodejs	14.17.5-r0
Alpine:v3.20	nodejs	14.17.5-r0
Alpine:v3.21	nodejs	14.17.5-r0
Alpine:v3.22	nodejs	14.17.5-r0
Alpine:v3.23	nodejs	14.17.5-r0
Alpine:v3.24	nodejs	14.17.5-r0
Debian:10	nodejs	10.24.0~dfsg-1~deb10u2
Debian:12	nodejs	12.22.5~dfsg-1
Debian:13	nodejs	12.22.5~dfsg-1
Debian:14	nodejs	12.22.5~dfsg-1
Red Hat:enterprise_linux:8	nodejs	1:14.17.5-1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	nodejs	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
Red Hat:enterprise_linux:8	nodejs-debuginfo	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
Red Hat:enterprise_linux:8	nodejs-debuginfo	1:14.17.5-1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	nodejs-debugsource	1:14.17.5-1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	nodejs-debugsource	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
Red Hat:enterprise_linux:8	nodejs-devel	1:14.17.5-1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	nodejs-devel	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
Red Hat:enterprise_linux:8	nodejs-docs	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
Red Hat:enterprise_linux:8	nodejs-docs	1:14.17.5-1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	nodejs-full-i18n	1:12.22.5-1.module+el8.4.0+12242+af52a4c7
Red Hat:enterprise_linux:8	nodejs-full-i18n	1:14.17.5-1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+11732+c668cc9f
Red Hat:enterprise_linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+6519+9f98ed83
Red Hat:enterprise_linux:8	nodejs-packaging	0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat:enterprise_linux:8	nodejs-packaging	0:23-3.module+el8.3.0+6519+9f98ed83
Red Hat:enterprise_linux:8	npm	1:6.14.14-1.14.17.5.1.module+el8.4.0+12247+e2879e58
Red Hat:enterprise_linux:8	npm	1:6.14.14-1.12.22.5.1.module+el8.4.0+12242+af52a4c7
Red Hat:rhel_eus:8.1	nodejs	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.1	nodejs-debuginfo	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.1	nodejs-debugsource	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.1	nodejs-devel	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.1	nodejs-docs	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.1	nodejs-full-i18n	1:12.22.5-1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.1	nodejs-nodemon	0:1.18.3-1.module+el8.1.0+3369+37ae6a45
Red Hat:rhel_eus:8.1	nodejs-packaging	0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat:rhel_eus:8.1	npm	1:6.14.14-1.12.22.5.1.module+el8.1.0+12238+63fe3aec
Red Hat:rhel_eus:8.2	nodejs	1:12.22.5-1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_eus:8.2	nodejs-debuginfo	1:12.22.5-1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_eus:8.2	nodejs-debugsource	1:12.22.5-1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_eus:8.2	nodejs-devel	1:12.22.5-1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_eus:8.2	nodejs-docs	1:12.22.5-1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_eus:8.2	nodejs-full-i18n	1:12.22.5-1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_eus:8.2	nodejs-nodemon	0:1.18.3-1.module+el8.1.0+3369+37ae6a45
Red Hat:rhel_eus:8.2	nodejs-packaging	0:17-3.module+el8.1.0+3369+37ae6a45
Red Hat:rhel_eus:8.2	npm	1:6.14.14-1.12.22.5.1.module+el8.2.0+12241+a3db445b
Red Hat:rhel_software_collections:3	rh-nodejs12-nodejs	0:12.22.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs12-nodejs-debuginfo	0:12.22.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs12-nodejs-devel	0:12.22.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs12-nodejs-docs	0:12.22.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs12-nodejs-nodemon	0:2.0.3-5.el7
Red Hat:rhel_software_collections:3	rh-nodejs12-npm	0:6.14.14-12.22.5.1.el7
Red Hat:rhel_software_collections:3	rh-nodejs14-nodejs	0:14.17.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs14-nodejs-debuginfo	0:14.17.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs14-nodejs-devel	0:14.17.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs14-nodejs-docs	0:14.17.5-1.el7
Red Hat:rhel_software_collections:3	rh-nodejs14-nodejs-nodemon	0:2.0.3-5.el7
Red Hat:rhel_software_collections:3	rh-nodejs14-npm	0:6.14.14-14.17.5.1.el7
Rocky Linux:8	nodejs	1:12.22.5-1.module+el8.4.0+647+e905fa21
Rocky Linux:8	nodejs	1:14.17.5-1.module+el8.4.0+654+17ff1d38
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.6.0+982+9fdca2d4
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.3.0+100+234774f7
Rocky Linux:8	nodejs-nodemon	0:2.0.3-1.module+el8.4.0+638+5344c6f7
Rocky Linux:8	nodejs-packaging	0:17-3.module+el8.3.0+101+f84c7154
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.5.0+733+de4fee6c
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.3.0+100+234774f7
Rocky Linux:8	nodejs-packaging	0:23-3.module+el8.7.0+1071+4bdda2a8
SUSE:Linux Enterprise Module for Web and Scripting 12	nodejs10	10.24.1-1.42.2
SUSE:Linux Enterprise Module for Web and Scripting 12	nodejs12	12.22.5-1.35.1
SUSE:Linux Enterprise Module for Web and Scripting 12	nodejs14	14.17.5-6.15.3
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2	nodejs10	10.24.1-1.39.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2	nodejs12	12.22.5-4.19.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2	nodejs14	14.17.5-5.15.5
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3	nodejs12	12.22.5-4.19.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3	nodejs14	14.17.5-5.15.5
Ubuntu:Pro:16.04:LTS	nodejs	no fix
Ubuntu:Pro:18.04:LTS	nodejs	no fix
Ubuntu:Pro:20.04:LTS	nodejs	no fix
openSUSE:Leap 15.2	nodejs10	10.24.1-lp152.2.18.1
openSUSE:Leap 15.2	nodejs12	12.22.5-lp152.3.18.1
openSUSE:Leap 15.2	nodejs14	14.17.5-lp152.14.1
openSUSE:Leap 15.3	nodejs10	10.24.1-1.39.2
openSUSE:Leap 15.3	nodejs12	12.22.5-4.19.1
openSUSE:Leap 15.3	nodejs14	14.17.5-5.15.5
openSUSE:Tumbleweed	nodejs14	14.17.5-1.2
openSUSE:Tumbleweed	nodejs16	16.6.2-2.2