CVE-2022-32222 Weak cryptography in Node
Node.js on Linux may load an insecure OpenSSL configuration file, potentially weakening cryptographic security for applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-32222?
CVE-2022-32222 is a medium-severity vulnerability in Nodejs Node.js, published on 14 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
Which versions are affected by CVE-2022-32222?
2 open source packages ship an affected version, including node and node-min. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
node Bitnami | From 18.0.0 | 18.5.0 |
node-min Bitnami | From 18.0.0 | 18.5.0 |
Products include Nodejs Node.js, Siemens Sinec Ins.
How do I fix CVE-2022-32222?
Upgrade node to 18.5.0 or later.
Is CVE-2022-32222 being exploited?
There is no known exploitation of CVE-2022-32222 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as BIT-node-2022-32222, BIT-node-min-2022-32222, GHSA-fxfc-w6xq-5pp8.