Out-of-bounds read in Node.js - CVE-2021-22918

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54624

Out-of-bounds read in Node.js - CVE-2021-22918

Published: July 8, 2021


Vulnerability identifier: #VU54624
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-22918
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in uv__idna_toascii() function in libuv, which is used to convert strings to ASCII. A remote attacker can force the application to resolve a specially crafted hostname, trigger an out-of-bounds read error and gain access to sensitive information or perform a denial of service (DoS) attack.


Affected software

Node.js
Arch Linux
Debian Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
openEuler
Ubuntu
App Connect Enterprise Certified Container
IBM Netcool Agile Service Manager
IBM Cloud Transformation Advisor
Rational Application Developer
IBM Spectrum Control
IBM Business Process Manager
IBM Business Automation Workflow
Cloud Pak for Security (CP4S)
IBM Cognos Controller
IBM QRadar Data Synchronization App
Planning Analytics Local
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
nodejs-nodemon
libuv1 (Debian package)
libuv1 (Ubuntu package)
dev-libs/libuv
libuv
libuv (Red Hat package)
rh-nodejs14-nodejs-nodemon (Red Hat package)
rh-nodejs12-nodejs-nodemon (Red Hat package)
v8-devel
npm
nodejs-docs
nodejs-debuginfo
nodejs-full-i18n
nodejs
nodejs-devel
nodejs-libs
nodejs-debugsource
npm10
nodejs10-docs
nodejs10
nodejs10-debuginfo
nodejs10-debugsource
nodejs10-devel
rh-nodejs12-nodejs (Red Hat package)
nodejs12
nodejs12-debuginfo
nodejs12-docs
npm12
nodejs12-devel
nodejs12-debugsource
nodejs-lts-erbium
rh-nodejs14-nodejs (Red Hat package)
nodejs14-debugsource
nodejs14-devel
npm14
nodejs14-docs
nodejs14-debuginfo
nodejs14
nodejs-lts-fermium
nodejs-packaging
IBM DataPower Gateway
Migration Toolkit for Containers
IBM App Connect Enterprise
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
Asset Repository in IBM Cloud Pak for Integration (CP4I)
SINEC INS

How to mitigate CVE-2021-22918

Install updates from vendor's website.

Node.js - addressed in versions 12.22.2, 14.17.2, 16.4.1
App Connect Enterprise Certified Container - update to 2.1
IBM Netcool Agile Service Manager - update to 1.1.13
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Planning Analytics Local - update to 2.0.1
IBM Cloud Transformation Advisor - update to 2.5.0
IBM DataPower Gateway - addressed in versions 10.0.1.5, 10.0.4.0
IBM App Connect Enterprise - addressed in versions 11.0.0.14, 12.0.2.0
IBM Cognos Controller - update to 11.0.1.0.3
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-4, 2021.3.1
Asset Repository in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-3, 2021.2.1-1
SINEC INS - update to 1.0.1.1
Migration Toolkit for Containers - update to 1.5.1
nodejs-nodemon - addressed in versions 1.18.3-1, 2.0.3-1
libuv1 (Debian package) - update to 1.24.1-1+deb10u1
libuv1 (Ubuntu package) - addressed in versions 1.34.2-1ubuntu1.3, 1.38.0-2ubuntu2.1, 1.40.0-1ubuntu0.1
dev-libs/libuv - update to 1.41.1
libuv - update to 1.41.1-1
libuv (Red Hat package) - update to 1.41.1-1.el8_4
rh-nodejs14-nodejs-nodemon (Red Hat package) - update to 2.0.3-2.el7
rh-nodejs12-nodejs-nodemon (Red Hat package) - update to 2.0.3-2.el7
IBM QRadar Data Synchronization App - update to 3.0.1
IBM Spectrum Control - update to 5.4.4
v8-devel - addressed in versions 6.8.275.32-1.10.21.0.8, 7.8.279.23-1.12.22.11.1
npm - addressed in versions 6.14.4-1.10.21.0.8, 6.14.16-1.12.22.11.1
npm - addressed in versions 6.14.13-1.12.22.3.2, 6.14.13-1.14.17.3.2, 6.14.14-1.12.22.5.1
IBM Business Process Manager - update to 8.5.7.0
nodejs-docs - addressed in versions 10.21.0-8, 12.22.11-1
nodejs-debuginfo - addressed in versions 10.21.0-8, 12.22.11-1
nodejs-full-i18n - addressed in versions 10.21.0-8, 12.22.11-1
nodejs - addressed in versions 10.21.0-8, 12.22.11-1
nodejs-devel - addressed in versions 10.21.0-8, 12.22.11-1
nodejs-libs - addressed in versions 10.21.0-8, 12.22.11-1
nodejs-debugsource - addressed in versions 10.21.0-8, 12.22.11-1
npm10 - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-docs - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10 - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-debuginfo - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-debugsource - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
nodejs10-devel - addressed in versions 10.24.1-1.36.1, 10.24.1-1.39.1
rh-nodejs12-nodejs (Red Hat package) - update to 12.22.2-1.el7
nodejs12 - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-debuginfo - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-docs - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
npm12 - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-devel - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs12-debugsource - addressed in versions 12.22.2-1.32.1, 12.22.2-4.16.1
nodejs-lts-erbium - update to 12.22.3-1
nodejs - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
nodejs-devel - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
nodejs-full-i18n - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
nodejs-docs - addressed in versions 12.22.3-2, 12.22.5-1, 14.17.3-2
rh-nodejs14-nodejs (Red Hat package) - update to 14.17.2-1.el7
nodejs14-debugsource - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-devel - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
npm14 - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-docs - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14-debuginfo - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs14 - addressed in versions 14.17.2-5.12.1, 14.17.2-6.12.1
nodejs-lts-fermium - update to 14.17.3-1
nodejs - update to 16.4.1-1
nodejs-packaging - addressed in versions 17-3, 23-3
IBM Business Automation Workflow - update to 21.0.3

External References

Related Security Bulletins