{"id":"CVE-2022-32222","aliases":["ALPINE-CVE-2022-32222","BIT-node-2022-32222","BIT-node-min-2022-32222","EUVD-2022-53423","GHSA-fxfc-w6xq-5pp8","MGASA-2022-0294"],"status":"published","title":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0...","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02186,"percentile":0.82532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310","CWE-326","CWE-427"],"published":"2022-07-14T00:00:00Z","modified":"2026-11-03T07:31:17Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs-current","fixed_in":["18.6.0-r0","18.9.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node","fixed_in":["18.5.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"node-min","fixed_in":["18.5.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6.0-r0"},{"fixed":"18.9.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node","ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.5.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"node-min","ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.5.0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.20.0-1.1.mga8"}]}],"bundled":6}],"products":[{"vendor":"nodejs","product":"node"},{"vendor":"nodejs","product":"node.js"},{"vendor":"siemens","product":"sinec_ins"}],"references":[{"url":"https://hackerone.com/reports/1695596","tags":["x_transferred","Exploit","evidence","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32222","tags":["web","advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220915-0001/"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf"},{"url":"https://github.com/advisories/GHSA-fxfc-w6xq-5pp8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-32222","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/32xxx/CVE-2022-32222.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0294.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30078","tags":["report"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.19.0","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.19.1","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.19.2","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.19.3","tags":["web"]},{"url":"https://github.com/nodejs/node/releases/tag/v14.20.0","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-32222","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2022-07-14T00:00:00Z","modified":"2025-04-30T22:24:46.826Z","cwes":["CWE-310"],"updated_at":"2026-11-02T14:34:36.578327Z"}],"euvd":[{"id":"EUVD-2022-53423","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2022-07-14T00:00:00Z","modified":"2025-04-30T22:24:46Z","updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-fxfc-w6xq-5pp8","title":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0...","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2022-07-15T00:00:19Z","modified":"2023-08-02T05:03:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-326","CWE-427"],"updated_at":"2026-11-02T14:54:43.567376Z"}],"nvd":[{"id":"CVE-2022-32222","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2022-07-14T15:15:08.437Z","modified":"2026-06-17T04:46:54.617Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310","CWE-427"],"updated_at":"2026-11-02T14:07:23.686531Z"}],"osv":[{"id":"ALPINE-CVE-2022-32222","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2022-07-14T15:15:08.437Z","modified":"2026-11-03T07:31:17.785040288Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"BIT-node-2022-32222","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2024-03-06T11:03:38.462Z","modified":"2026-09-08T08:48:17.646201569Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-node-min-2022-32222","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2024-12-16T14:02:06.518Z","modified":"2026-09-08T08:48:17.299840307Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CVE-2022-32222","description":"A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.","status":"published","published":"2022-07-14T00:00:00Z","modified":"2026-10-28T02:31:06.948750542Z","cwes":["CWE-310"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"MGASA-2022-0294","title":"Updated nodejs packages fix security vulnerability","description":"The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an\ninstallation even if dependency information in package-lock.json differs\nfrom package.json. This behavior is inconsistent with the documentation,\nand makes it easier for attackers to install malware that was supposed to\nhave been blocked by an exact version match requirement in\npackage-lock.json. (CVE-2021-43616)\n\nDNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)\n\nHTTP Request Smuggling - Flawed Parsing of Transfer-Encoding\n(CVE-2022-32213)\n\nHTTP Request Smuggling - Improper Delimiting of Header Fields\n(CVE-2022-32214)\n\nHTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding\n(CVE-2022-32215)\n\nAttempt to read openssl.cnf from /home/iojs/build/ upon startup\n(CVE-2022-32222)\n","status":"published","published":"2022-08-25T21:21:07Z","modified":"2026-04-16T04:43:07.822208697Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}