CVE:CVE-2021-22884
CNNVD:CNNVD-202102-1511
nodejs是是一个基于ChromeV8引擎的JavaScript运行环境通过对Chromev8引擎进行了封装以及使用事件驱动和非阻塞IO的应用让Javascript开发高性能的后台应用成为了可能。
Nodejs 存在安全漏洞，攻击者可利用该漏洞可以通过DNS重新绑定节点核心的Localhost6，利用漏洞来运行代码。以下产品和版本受到影响：Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0
solution:Upgrade nodejs node.js to a higher version than 10.24.0,12.21.0,14.16.0,15.10.0,and avoid the version [10.0.0,10.24.0),[12.0.0,12.21.0),[14.0.0,14.16.0),[15.0.0,15.10.0); Upgrade fedoraproject fedora to a higher version than 32,33,34,and avoid the version 32,33,34; Upgrade netapp active_iq_unified_manager to a higher version than -; Upgrade netapp e-series_performance_analyzer to a higher version than -; Upgrade netapp oncommand_insight to a higher version than -; Upgrade netapp oncommand_workflow_automation to a higher version than -; Upgrade netapp snapcenter to a higher version than -; Upgrade oracle graalvm to a higher version than 19.3.5,20.3.1.2,21.0.0.2,and avoid the version 19.3.5,20.3.1.2,21.0.0.2; Upgrade oracle jd_edwards_enterpriseone_tools to a higher version than 9.2.6.0,and avoid the version (,9.2.6.0); Upgrade oracle mysql_cluster to a higher version than 8.0.25,and avoid the version (,8.0.25]; Upgrade oracle nosql_database to a higher version than 20.3,and avoid the version (,20.3); Upgrade oracle peoplesoft_enterprise_peopletools to a higher version than 8.58,8.59,and avoid the version 8.58,8.59; Upgrade siemens sinec_infrastructure_network_services to a higher version than 1.0.1.1,and avoid the version (,1.0.1.1)