Undici vulnerable to Regular Expression Denial of Service in Headers
Résumé
Undici vulnerable to Regular Expression Denial of Service in Headers
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the Headers.set() and Headers.append() methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the headerValueNormalize() utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2023-24807 nodejs Corrigé dans: 16.19.1-r0
- Debian DEBIAN-CVE-2023-24807 node-undici Corrigé dans: 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch github.com
- web github.com
- web hackerone.com