CVE-2022-31150
CRLF injection in request headers
Résumé
CRLF injection in request headers
Description d'origine
La description telle que publiée par la source (souvent en anglais).
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-31150 node-undici Corrigé dans: 5.8.0+dfsg1+~cs18.9.16-1
- Ubuntu UBUNTU-CVE-2022-31150 node-undici
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- web github.com
- web hackerone.com