Sign-up

ID

VAR-202207-0378


CVE

CVE-2022-32222


TITLE

Node.js Foundation  of  Node.js  Uncontrolled Search Path Element Vulnerability in Products from Other Vendors

Trust: 0.8

sources: JVNDB: JVNDB-2022-013242

DESCRIPTION

A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3. Node.js Foundation of Node.js Products from multiple other vendors are vulnerable to uncontrolled search path elements.Information may be tampered with. Node.js July 7th 2022 Security Releases: Attempt to read openssl.cnf from /home/iojs/build/ upon startup. When Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily doesn't exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202405-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Node.js: Multiple Vulnerabilities Date: May 08, 2024 Bugs: #772422, #781704, #800986, #805053, #807775, #811273, #817938, #831037, #835615, #857111, #865627, #872692, #879617, #918086, #918614 ID: 202405-29 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Node.js. Background ========= Node.js is a JavaScript runtime built on Chrome’s V8 JavaScript engine. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Node.js 20 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/nodejs-20.5.1" All Node.js 18 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/nodejs-18.17.1" All Node.js 16 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/nodejs-16.20.2" References ========= [ 1 ] CVE-2020-7774 https://nvd.nist.gov/vuln/detail/CVE-2020-7774 [ 2 ] CVE-2021-3672 https://nvd.nist.gov/vuln/detail/CVE-2021-3672 [ 3 ] CVE-2021-22883 https://nvd.nist.gov/vuln/detail/CVE-2021-22883 [ 4 ] CVE-2021-22884 https://nvd.nist.gov/vuln/detail/CVE-2021-22884 [ 5 ] CVE-2021-22918 https://nvd.nist.gov/vuln/detail/CVE-2021-22918 [ 6 ] CVE-2021-22930 https://nvd.nist.gov/vuln/detail/CVE-2021-22930 [ 7 ] CVE-2021-22931 https://nvd.nist.gov/vuln/detail/CVE-2021-22931 [ 8 ] CVE-2021-22939 https://nvd.nist.gov/vuln/detail/CVE-2021-22939 [ 9 ] CVE-2021-22940 https://nvd.nist.gov/vuln/detail/CVE-2021-22940 [ 10 ] CVE-2021-22959 https://nvd.nist.gov/vuln/detail/CVE-2021-22959 [ 11 ] CVE-2021-22960 https://nvd.nist.gov/vuln/detail/CVE-2021-22960 [ 12 ] CVE-2021-37701 https://nvd.nist.gov/vuln/detail/CVE-2021-37701 [ 13 ] CVE-2021-37712 https://nvd.nist.gov/vuln/detail/CVE-2021-37712 [ 14 ] CVE-2021-39134 https://nvd.nist.gov/vuln/detail/CVE-2021-39134 [ 15 ] CVE-2021-39135 https://nvd.nist.gov/vuln/detail/CVE-2021-39135 [ 16 ] CVE-2021-44531 https://nvd.nist.gov/vuln/detail/CVE-2021-44531 [ 17 ] CVE-2021-44532 https://nvd.nist.gov/vuln/detail/CVE-2021-44532 [ 18 ] CVE-2021-44533 https://nvd.nist.gov/vuln/detail/CVE-2021-44533 [ 19 ] CVE-2022-0778 https://nvd.nist.gov/vuln/detail/CVE-2022-0778 [ 20 ] CVE-2022-3602 https://nvd.nist.gov/vuln/detail/CVE-2022-3602 [ 21 ] CVE-2022-3786 https://nvd.nist.gov/vuln/detail/CVE-2022-3786 [ 22 ] CVE-2022-21824 https://nvd.nist.gov/vuln/detail/CVE-2022-21824 [ 23 ] CVE-2022-32212 https://nvd.nist.gov/vuln/detail/CVE-2022-32212 [ 24 ] CVE-2022-32213 https://nvd.nist.gov/vuln/detail/CVE-2022-32213 [ 25 ] CVE-2022-32214 https://nvd.nist.gov/vuln/detail/CVE-2022-32214 [ 26 ] CVE-2022-32215 https://nvd.nist.gov/vuln/detail/CVE-2022-32215 [ 27 ] CVE-2022-32222 https://nvd.nist.gov/vuln/detail/CVE-2022-32222 [ 28 ] CVE-2022-35255 https://nvd.nist.gov/vuln/detail/CVE-2022-35255 [ 29 ] CVE-2022-35256 https://nvd.nist.gov/vuln/detail/CVE-2022-35256 [ 30 ] CVE-2022-35948 https://nvd.nist.gov/vuln/detail/CVE-2022-35948 [ 31 ] CVE-2022-35949 https://nvd.nist.gov/vuln/detail/CVE-2022-35949 [ 32 ] CVE-2022-43548 https://nvd.nist.gov/vuln/detail/CVE-2022-43548 [ 33 ] CVE-2023-30581 https://nvd.nist.gov/vuln/detail/CVE-2023-30581 [ 34 ] CVE-2023-30582 https://nvd.nist.gov/vuln/detail/CVE-2023-30582 [ 35 ] CVE-2023-30583 https://nvd.nist.gov/vuln/detail/CVE-2023-30583 [ 36 ] CVE-2023-30584 https://nvd.nist.gov/vuln/detail/CVE-2023-30584 [ 37 ] CVE-2023-30586 https://nvd.nist.gov/vuln/detail/CVE-2023-30586 [ 38 ] CVE-2023-30587 https://nvd.nist.gov/vuln/detail/CVE-2023-30587 [ 39 ] CVE-2023-30588 https://nvd.nist.gov/vuln/detail/CVE-2023-30588 [ 40 ] CVE-2023-30589 https://nvd.nist.gov/vuln/detail/CVE-2023-30589 [ 41 ] CVE-2023-30590 https://nvd.nist.gov/vuln/detail/CVE-2023-30590 [ 42 ] CVE-2023-32002 https://nvd.nist.gov/vuln/detail/CVE-2023-32002 [ 43 ] CVE-2023-32003 https://nvd.nist.gov/vuln/detail/CVE-2023-32003 [ 44 ] CVE-2023-32004 https://nvd.nist.gov/vuln/detail/CVE-2023-32004 [ 45 ] CVE-2023-32005 https://nvd.nist.gov/vuln/detail/CVE-2023-32005 [ 46 ] CVE-2023-32006 https://nvd.nist.gov/vuln/detail/CVE-2023-32006 [ 47 ] CVE-2023-32558 https://nvd.nist.gov/vuln/detail/CVE-2023-32558 [ 48 ] CVE-2023-32559 https://nvd.nist.gov/vuln/detail/CVE-2023-32559 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202405-29 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

Trust: 1.8

sources: NVD: CVE-2022-32222 // JVNDB: JVNDB-2022-013242 // VULMON: CVE-2022-32222 // PACKETSTORM: 178512

AFFECTED PRODUCTS

vendor:siemensmodel:sinec insscope:eqversion:1.0

Trust: 1.0

vendor:siemensmodel:sinec insscope:ltversion:1.0

Trust: 1.0

vendor:nodejsmodel:node.jsscope:gteversion:18.0.0

Trust: 1.0

vendor:nodejsmodel:node.jsscope:ltversion:18.5.0

Trust: 1.0

vendor:node jsmodel:node.jsscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinec insscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-013242 // NVD: CVE-2022-32222

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-32222
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-32222
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202207-682
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-32222
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2022-32222
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-013242 // CNNVD: CNNVD-202207-682 // NVD: CVE-2022-32222

PROBLEMTYPE DATA

problemtype:CWE-310

Trust: 1.0

problemtype:CWE-427

Trust: 1.0

problemtype:Uncontrolled search path elements (CWE-427) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-013242 // NVD: CVE-2022-32222

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-682

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202207-682

EXTERNAL IDS

db:NVDid:CVE-2022-32222

Trust: 3.4

db:HACKERONEid:1695596

Trust: 2.4

db:JVNDBid:JVNDB-2022-013242

Trust: 0.8

db:CS-HELPid:SB2022071338

Trust: 0.6

db:SIEMENSid:SSA-332410

Trust: 0.6

db:CNNVDid:CNNVD-202207-682

Trust: 0.6

db:VULMONid:CVE-2022-32222

Trust: 0.1

db:PACKETSTORMid:178512

Trust: 0.1

sources: VULMON: CVE-2022-32222 // JVNDB: JVNDB-2022-013242 // PACKETSTORM: 178512 // CNNVD: CNNVD-202207-682 // NVD: CVE-2022-32222

REFERENCES

url:https://hackerone.com/reports/1695596

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-32222

Trust: 0.9

url:https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/

Trust: 0.7

url:https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf

Trust: 0.6

url:https://security.netapp.com/advisory/ntap-20220915-0001/

Trust: 0.6

url:https://access.redhat.com/security/cve/cve-2022-32222

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-32222/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022071338

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-22960

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30587

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32006

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22931

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22939

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32558

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30588

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-21824

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-3672

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44532

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-35949

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22959

Trust: 0.1

url:https://security.gentoo.org/glsa/202405-29

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22918

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32004

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-43548

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30584

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-7774

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30589

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32003

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32212

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22883

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32214

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0778

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22884

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-35948

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-35255

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44533

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32002

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30582

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-3602

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-3786

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30590

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30586

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-35256

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32213

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-32215

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22940

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32005

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-32559

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-22930

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-39135

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-39134

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30581

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-37712

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-30583

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-44531

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2021-37701

Trust: 0.1

sources: VULMON: CVE-2022-32222 // JVNDB: JVNDB-2022-013242 // PACKETSTORM: 178512 // CNNVD: CNNVD-202207-682 // NVD: CVE-2022-32222

CREDITS

Gentoo

Trust: 0.1

sources: PACKETSTORM: 178512

SOURCES

db:VULMONid:CVE-2022-32222
db:JVNDBid:JVNDB-2022-013242
db:PACKETSTORMid:178512
db:CNNVDid:CNNVD-202207-682
db:NVDid:CVE-2022-32222

LAST UPDATE DATE

2024-08-14T12:52:43.493000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2022-013242date:2023-09-06T08:23:00
db:CNNVDid:CNNVD-202207-682date:2023-07-25T00:00:00
db:NVDid:CVE-2022-32222date:2023-07-24T13:16:33.287

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2022-013242date:2023-09-06T00:00:00
db:PACKETSTORMid:178512date:2024-05-09T15:46:44
db:CNNVDid:CNNVD-202207-682date:2022-07-08T00:00:00
db:NVDid:CVE-2022-32222date:2022-07-14T15:15:08.437