Node.js Certificate Verification Bypass via String Injection

密码学缺陷 / Improper Following of a Certificate's Chain of Trust / #1429694

厂商

Node.js

严重程度

低危 · CVSS 6.8

赏金

—

弱点

Improper Following of a Certificate's Chain of Trust

研究员

@bengl

披露日期

2022-02-10

资产

https://github.com/nodejs/node

CVE

CVE-2021-44531CVE-2021-44532CVE-2021-44533

该报告还没有中文解读。

This is a report on behalf of Google, who did not want to report through H1.

X509v3 Subject Alternative Name:  
  DNS:*.nodejs.org, DNS:nodejs.org