Bug 2172190 (CVE-2023-23936)

Summary:	CVE-2023-23936 Node.js: Fetch API did not protect against CRLF injection in host headers
Product:	[Other] Security Response	Reporter:	Zack Miele <zmiele>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amackenz, amasferr, chazlett, jstanek, mkudlej, nodejs-maint, tjochec, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Node.js 19.6.1, Node.js 18.14.1, Node.js 16.19.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-09 20:48:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2172191, 2172192, 2172193, 2172194, 2172195, 2172196, 2172197, 2172198, 2172199, 2172200, 2178118, 2178119, 2178120, 2178121, 2178122, 2178123, 2178124, 2178125, 2178160, 2178161, 2178162
Bug Blocks:	2171920

Description Zack Miele 2023-02-21 16:13:50 UTC

The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection.

Comment 1 Zack Miele 2023-02-21 16:14:30 UTC

Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 2172191]
Affects: fedora-all [bug 2172195]


Created nodejs:16-epel/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2172192]


Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2172193]


Created nodejs:18/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2172194]

Comment 5 errata-xmlrpc 2023-04-04 09:48:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1582 https://access.redhat.com/errata/RHSA-2023:1582

Comment 6 errata-xmlrpc 2023-04-04 09:48:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:1583 https://access.redhat.com/errata/RHSA-2023:1583

Comment 7 errata-xmlrpc 2023-05-09 11:46:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2654 https://access.redhat.com/errata/RHSA-2023:2654

Comment 8 errata-xmlrpc 2023-05-09 11:46:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2655 https://access.redhat.com/errata/RHSA-2023:2655

Comment 9 Product Security DevOps Team 2023-05-09 20:48:42 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-23936

Comment 11 errata-xmlrpc 2023-10-09 10:26:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533