CVE-2022-32222

A vulnerability was found in NodeJS. The issue occurs when Node.js starts on Linux based systems and attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf, which ordinarily does not exist. This flaw allows an attacker on some shared systems to create this file and affect the default OpenSSL configuration for other users.

This issue is specific to the nodejs:v18 stream. This issue is contained within the OpenSSL library bundled upstream. We remove this library during the build and instead, use the one on the system, therefore, this issue does not affect us.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.