Security features bypass in Node.js - CVE-2022-32222

Vulnerability identifier: #VU65280

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32222

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions

The vulnerability exists due to Node.js after start on linux based systems attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily doesn't exist. A remote unauthenticated attacker can attemp to read openssl.cnf from /home/iojs/build/ upon startup to create this file and affect the default OpenSSL configuration for other users.

Node.js
Gentoo Linux
Amazon Linux AMI
Answer Retrieval for Watson Discovery On Prem
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
IBM Planning Analytics Workspace
Cognos Dashboards on Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Cloud Pak for Multicloud Management Monitoring
IBM Spectrum Protect Plus
Event Streams
IBM Cognos Controller
SINEC INS
nodejs

Install updates from vendor's website.

Node.js - update to 18.9.1
Answer Retrieval for Watson Discovery On Prem - update to 2.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.0
Event Streams - update to 11.0.4
IBM Cognos Controller - update to 11.0.1.0.3
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-9, 2022.2-1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 2020.4.1-8, 2022.2.1-1
SINEC INS - update to 1.0 SP2 Update 1
IBM Planning Analytics Workspace - update to 2.0.82
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 7
Cognos Dashboards on Cloud Pak for Data - update to 4.7.2
IBM Spectrum Protect Plus - update to 10.1.12
nodejs - update to 18.12.1-1

• https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/

• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak
• Multiple vulnerabilities in Node.js
• Multiple vulnerabilities in IBM Event Streams
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• IBM Watson Discovery for IBM Cloud Pak for Data update for Node.js
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in IBM Cognos Dashboards on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management Monitoring
• Gentoo update for Node.js
• Amazon Linux AMI update for nodejs
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Spectrum Protect Plus