CVE-2022-21824

Reference Links

• https://exchange.xforce.ibmcloud.com/vulnerabilities/216933
• https://www.ibm.com/support/pages/node/6615285 (Advisory)
• https://hackerone.com/reports/1431042
• https://lists.debian.org/debian-lts-announce/2022/10/msg00006.html
• https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• https://security.netapp.com/advisory/ntap-20220325-0007/
• https://security.netapp.com/advisory/ntap-20220729-0004/
• https://www.debian.org/security/2022/dsa-5170
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2040867
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2040863
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2040864
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2040865
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2040866
• https://github.com/nodejs/node/commit/3454e797137b1706b11ff2f6f7fb60263b39396b
• https://access.redhat.com/errata/RHSA-2022:4914
• https://access.redhat.com/security/cve/cve-2022-21824
• https://access.redhat.com/errata/RHSA-2022:7044
• https://access.redhat.com/errata/RHSA-2022:7830
• https://access.redhat.com/errata/RHSA-2022:9073
• https://access.redhat.com/errata/RHSA-2023:1742
• https://access.redhat.com/errata/RHSA-2023:3742
• https://bugzilla.redhat.com/show_bug.cgi?id=2040862
• https://www.cve.org/CVERecord?id=CVE-2022-21824 https://nvd.nist.gov/vuln/detail/CVE-2022-21824 https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/
• https://access.redhat.com/errata/RHEA-2022:5139
• https://access.redhat.com/errata/RHEA-2022:4925
• https://access.redhat.com/errata/RHEA-2022:5221
• https://access.redhat.com/errata/RHEA-2022:5615
• https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/#prototype-pollution-via-console-table-properties-low-cve-2022-21824
• https://github.com/nodejs/node/commit/be69403528da99bf3df9e1dc47186f18ba59cb5e
• https://security-tracker.debian.org/tracker/CVE-2022-21824

Parent vulnerabilities

(Appears in the following advisories)

• RHEA-2022:5139
• RHSA-2022:7830
• RHSA-2022:9073
• RHEA-2022:4925
• RHEA-2022:5221
• RHEA-2022:5615
• RHSA-2023:1742
• RHSA-2022:4914
• RHSA-2022:7044
• RHSA-2023:3742
• IBM-6615285

Frequently Asked Questions

• What is the vulnerability ID?

  The vulnerability ID is CVE-2022-21824.

• What is the severity of CVE-2022-21824?

  The severity of CVE-2022-21824 is high (8.2).

• Which software is affected by CVE-2022-21824?

  The following software are affected by CVE-2022-21824: - Node.js versions up to 12.22.9 - Node.js versions up to 14.18.3 - Node.js versions up to 16.13.2 - Node.js versions up to 17.3.1 - Rh-nodejs12-nodejs versions up to 0:12.22.12-2.el7 - Rh-nodejs14-nodejs versions up to 0:14.20.1-2.el7 - Debian Node.js version 10.24.0~dfsg-1~deb10u1 - Oracle MySQL Cluster versions up to 8.0.29 - Oracle MySQL Connectors versions up to 8.0.28 - Oracle MySQL Enterprise Monitor versions up to 8.0.29 - Oracle MySQL Server versions up to 8.0.29 - Oracle MySQL Workbench versions up to 8.0.28 - Oracle PeopleSoft Enterprise PeopleTools version 8.58 - Oracle PeopleSoft Enterprise PeopleTools version 8.59 - Debian Debian Linux version 10.0 - Debian Debian Linux version 11.0 - NetApp OnCommand Insight - NetApp OnCommand Workflow Automation - Netapp Snapcenter - IBM Cognos Analytics 11.2.x - IBM Cognos Analytics 11.1.x

• How does CVE-2022-21824 impact Node.js?

  CVE-2022-21824 impacts Node.js by allowing user-controlled input to be passed to the 'properties' parameter of the 'console.table()' function, potentially leading to prototype pollution.

• How can CVE-2022-21824 be fixed?

  To fix CVE-2022-21824, it is recommended to upgrade to the following versions: - Node.js 12.22.9 - Node.js 14.18.3 - Node.js 16.13.2 Or apply the appropriate patch provided by your software vendor.