CVE-2022-35256
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTT...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Paquets affectés
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.20.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.17.1"},{"introduced":"18.0.0"},{"fixed":"18.9.1"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"14.14.1"},{"introduced":"14.15.0"},{"fixed":"14.20.1"},{"introduced":"16.0.0"},{"fixed":"16.12.1"},{"introduced":"16.13.0"},{"fixed":"16.17.1"},{"introduced":"18.0.0"},{"fixed":"18.9.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2022-35256 nodejs Corrigé dans: 14.20.1-r0
- Debian DEBIAN-CVE-2022-35256 nodejs Corrigé dans: 12.22.12~dfsg-1~deb11u3
Références
- advisory debian.org
- advisory nvd.nist.gov
- advisory github.com
- web hackerone.com
- web cert-portal.siemens.com