Undici vulnerable to Regular Expression Denial of Service in Headers
概要
Undici vulnerable to Regular Expression Denial of Service in Headers
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2023-24807 nodejs 修正版: 16.19.1-r0
- Debian DEBIAN-CVE-2023-24807 node-undici 修正版: 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- web github.com
- web hackerone.com