PT-2022-21160 · Node.Js · Node.Js

Mhdawson · Published 2022-07-14 · Updated 2024-12-16 · CVE-2022-32222

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Node.js versions 18.x prior to 18.40.0

Description A cryptographic issue exists in Node.js on Linux, where the default path for openssl.cnf might be accessible to a non-admin user under certain circumstances, instead of being located in /etc/ssl as in previous versions before the upgrade to OpenSSL 3.

Recommendations For versions prior to 18.40.0, update to version 18.40.0 or later to resolve the issue.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-310

CWE-427

Related Identifiers

BIT-NODE-2022-32222

BIT-NODE-MIN-2022-32222

CVE-2022-32222

MGASA-2022-0294

Affected Products

Node.Js

References · 17

• 🔥 https://hackerone.com/reports/1695596 · Exploit
• https://osv.dev/vulnerability/BIT-node-min-2022-32222 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32222 · Security Note
• https://advisories.mageia.org/MGASA-2022-0294.html · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0294 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32222 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-node-2022-32222 · Vendor Advisory
• https://github.com/nodejs/node/releases/tag/v14.20.0 · Note
• https://github.com/nodejs/node/releases/tag/v14.19.2 · Note
• https://github.com/nodejs/node/releases/tag/v14.19.0 · Note
• https://github.com/nodejs/node/releases/tag/v14.19.1 · Note
• https://github.com/nodejs/node/releases/tag/v14.19.3 · Note
• https://bugs.mageia.org/show_bug.cgi?id=30078 · Note
• https://nodejs.org/en/blog/vulnerability/july-2022-security-releases · Note
• https://t.me/cvenotify/44838 · Telegram Post