CVE-2022-32222: Node 18 reads openssl.cnf from /home/iojs/build/... upon startup on macOS

In Node.js 18 and later, at startup, the process attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf on MacOS which ordinarily doesn't exist. The attack would be an attacker with access to a shared MacOS host with a self-chosen username (iojs) being able to affect the OpenSSF configuration of other users.

All versions of the 18.x releases lines.

— Node.Js

Node.js could allow a remote attacker to bypass security restrictions. By attempting to read openssl.cnf from /home/iojs/build/ upon startup, an attacker could exploit this vulnerability to create this file and affect the default OpenSSL configuration for other users.

— IBM

On linux, versions of 18.x prior to Y used a default path for openssl.cnf that was within a path that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.

— Node.Js