CVE-2021-22918
12.07.2021, 11:15
Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nodejs | node.js | 12.0.0 ≤ 𝑥 < 12.22.2 |
| nodejs | node.js | 14.0.0 ≤ 𝑥 < 14.17.2 |
| nodejs | node.js | 16.0.0 ≤ 𝑥 < 16.4.1 |
| siemens | sinec_infrastructure_network_services | 𝑥 < 1.0.1.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libuv-devel |
| ||||||||||||||||||
| libuv1 |
| ||||||||||||||||||
| nodejs10 |
| ||||||||||||||||||
| nodejs10-devel |
| ||||||||||||||||||
| nodejs10-docs |
| ||||||||||||||||||
| nodejs12 |
| ||||||||||||||||||
| nodejs12-devel |
| ||||||||||||||||||
| nodejs12-docs |
| ||||||||||||||||||
| nodejs14 |
| ||||||||||||||||||
| nodejs14-devel |
| ||||||||||||||||||
| nodejs14-docs |
| ||||||||||||||||||
| npm10 |
| ||||||||||||||||||
| npm12 |
| ||||||||||||||||||
| npm14 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| libuv |
| ||||||||||
| libuv-devel |
|
Common Weakness Enumeration
References