CVE-2023-23936
CRLF Injection in Nodejs ‘undici’ via host
Résumé
CRLF Injection in Nodejs ‘undici’ via host
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
undici
[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"5.19.1"}]}]
Bitnami
node-min
[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]
Bitnami
node
[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"16.19.1"},{"introduced":"18.0.0"},{"fixed":"18.14.1"},{"introduced":"19.0.0"},{"fixed":"19.6.1"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-23936 nodejs Corrigé dans: 16.19.1-r0
- Debian DEBIAN-CVE-2023-23936 node-undici Corrigé dans: 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web hackerone.com
- web github.com