CVE-2022-31150
CRLF injection in request headers
概要
CRLF injection in request headers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-31150 node-undici 修正版: 5.8.0+dfsg1+~cs18.9.16-1
- Ubuntu UBUNTU-CVE-2022-31150 node-undici
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- web github.com
- web hackerone.com