| Package | Affected versions | Patched versions |
|---|---|---|
| node.js | ≥ 14.0.0, < 14.18.3≥ 16.0.0, < 16.13.2≥ 17.0.0, < 17.3.1< 12.22.9 | 14.18.316.13.217.3.112.22.9 |
| graalvm | = 20.3.5= 21.3.1= 22.0.0.2 | |
| mysql cluster | ≤ 8.0.29 | |
| mysql connectors | ≤ 8.0.28 | |
| mysql enterprise monitor | ≤ 8.0.29 | |
| mysql server | ≥ 8.0.0, ≤ 8.0.28≤ 5.7.37 | |
| mysql workbench | ≤ 8.0.28 | |
| peoplesoft enterprise peopletools | = 8.58= 8.59 |
Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free