CVE-2021-22918
Summary
| CVE | CVE-2021-22918 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-07-12 11:15:00 UTC |
| Updated | 2024-01-16 13:15:00 UTC |
| Description | Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo(). |
Risk And Classification
Problem Types: CWE-125
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| July 2021 Node.js Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| libuv: Buffer Overread (GLSA 202401-23) — Gentoo security | security.gentoo.org | ||
| July 2021 Security Releases | Node.js | MISC | nodejs.org | |
| cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | CONFIRM | cert-portal.siemens.com | |
| HackerOne | MISC | hackerone.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159331 Oracle Enterprise Linux Security Update for libuv (ELSA-2021-3075)
- 159345 Oracle Enterprise Linux Security Update for nodejs:12 (ELSA-2021-3073)
- 159346 Oracle Enterprise Linux Security Update for nodejs:14 (ELSA-2021-3074)
- 178697 Debian Security Update for libuv1 (DSA 4936-1)
- 180501 Debian Security Update for libuv1 (CVE-2021-22918)
- 198428 Ubuntu Security Notification for libuv vulnerability (USN-5007-1)
- 239531 Red Hat Update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2021:2932)
- 239532 Red Hat Update for rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon (RHSA-2021:2931)
- 239546 Red Hat Update for libuv (RHSA-2021:3075)
- 239547 Red Hat Update for nodejs:14 (RHSA-2021:3074)
- 239548 Red Hat Update for nodejs:12 (RHSA-2021:3073)
- 239654 Red Hat Update for nodejs:12 (RHSA-2021:3639)
- 239655 Red Hat Update for nodejs:12 (RHSA-2021:3638)
- 375691 Node.js Multiple Vulnerabilities July 2021
- 377329 Alibaba Cloud Linux Security Update for nodejs:14 (ALINUX3-SA-2021:0056)
- 377415 Alibaba Cloud Linux Security Update for libuv (ALINUX3-SA-2022:0099)
- 500442 Alpine Linux Security Update for nodejs
- 501451 Alpine Linux Security Update for nodejs
- 690034 Free Berkeley Software Distribution (FreeBSD) Security Update for node.js (c174118e-1b11-11ec-9d9d-0022489ad614)
- 710841 Gentoo Linux libuv Buffer Overread Vulnerability (GLSA 202401-23)
- 750833 OpenSUSE Security Update for nodejs12 (openSUSE-SU-2021:2327-1)
- 750837 SUSE Enterprise Linux Security Update for nodejs10 (SUSE-SU-2021:2353-1)
- 750840 OpenSUSE Security Update for nodejs10 (openSUSE-SU-2021:2353-1)
- 750841 OpenSUSE Security Update for nodejs14 (openSUSE-SU-2021:2354-1)
- 750857 OpenSUSE Security Update for nodejs14 (openSUSE-SU-2021:1060-1)
- 750858 OpenSUSE Security Update for nodejs10 (openSUSE-SU-2021:1061-1)
- 750859 OpenSUSE Security Update for nodejs12 (openSUSE-SU-2021:1059-1)
- 900253 CBL-Mariner Linux Security Update for nodejs 14.17.0
- 903648 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (4434)
- 940245 AlmaLinux Security Update for nodejs:14 (ALSA-2021:3074)
- 940359 AlmaLinux Security Update for libuv (ALSA-2021:3075)
- 940398 AlmaLinux Security Update for nodejs:12 (ALSA-2021:3073)
- 960199 Rocky Linux Security Update for libuv (RLSA-2021:3075)