|
8 | 8 | </tr> |
9 | 9 | <tr> |
10 | 10 | <td> |
| 11 | +<a href="#17.3.1">17.3.1</a><br/> |
11 | 12 | <a href="#17.3.0">17.3.0</a><br/> |
12 | 13 | <a href="#17.2.0">17.2.0</a><br/> |
13 | 14 | <a href="#17.1.0">17.1.0</a><br/> |
|
36 | 37 | * [io.js](CHANGELOG_IOJS.md) |
37 | 38 | * [Archive](CHANGELOG_ARCHIVE.md) |
38 | 39 |
|
| 40 | +<a id="17.3.1"></a> |
| 41 | + |
| 42 | +## 2022-01-10, Version 17.3.1 (Current), @BethGriggs |
| 43 | + |
| 44 | +This is a security release. |
| 45 | + |
| 46 | +### Notable changes |
| 47 | + |
| 48 | +#### Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531) |
| 49 | + |
| 50 | +Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly. |
| 51 | + |
| 52 | +Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the `--security-revert` command-line option. |
| 53 | + |
| 54 | +More details will be available at [CVE-2021-44531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531) after publication. |
| 55 | + |
| 56 | +#### Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532) |
| 57 | + |
| 58 | +Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints. |
| 59 | + |
| 60 | +Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the `--security-revert` command-line option. |
| 61 | + |
| 62 | +More details will be available at [CVE-2021-44532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532) after publication. |
| 63 | + |
| 64 | +#### Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533) |
| 65 | + |
| 66 | +Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. |
| 67 | + |
| 68 | +Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable. |
| 69 | + |
| 70 | +More details will be available at [CVE-2021-44533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533) after publication. |
| 71 | + |
| 72 | +#### Prototype pollution via `console.table` properties (Low)(CVE-2022-21824) |
| 73 | + |
| 74 | +Due to the formatting logic of the `console.table()` function it was not safe to allow user controlled input to be passed to the `properties` parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be `__proto__`. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype. |
| 75 | + |
| 76 | +Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to. |
| 77 | + |
| 78 | +More details will be available at [CVE-2022-21824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824) after publication. |
| 79 | + |
| 80 | +Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability. |
| 81 | + |
| 82 | +### Commits |
| 83 | + |
| 84 | +* \[[`2a0515f73c`](https://github.com/nodejs/node/commit/2a0515f73c)] - **console**: fix prototype pollution via console.table (Tobias Nießen) [nodejs-private/node-private#307](https://github.com/nodejs-private/node-private/pull/307) |
| 85 | +* \[[`2e2c45553d`](https://github.com/nodejs/node/commit/2e2c45553d)] - **crypto,tls**: implement safe x509 GeneralName format (Tobias Nießen) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300) |
| 86 | +* \[[`df3141f59b`](https://github.com/nodejs/node/commit/df3141f59b)] - **src**: add cve reverts and associated tests (Michael Dawson) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300) |
| 87 | +* \[[`5398548746`](https://github.com/nodejs/node/commit/5398548746)] - **src**: remove unused x509 functions (Tobias Nießen) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300) |
| 88 | +* \[[`1f7fdff64a`](https://github.com/nodejs/node/commit/1f7fdff64a)] - **tls**: fix handling of x509 subject and issuer (Tobias Nießen) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300) |
| 89 | +* \[[`b11b4cc69d`](https://github.com/nodejs/node/commit/b11b4cc69d)] - **tls**: drop support for URI alternative names (Tobias Nießen) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300) |
| 90 | + |
39 | 91 | <a id="17.3.0"></a> |
40 | 92 |
|
41 | 93 | ## 2021-12-17, Version 17.3.0 (Current), @danielleadams |
|
0 commit comments