Bug 2219841 (CVE-2023-30589) - CVE-2023-30589 nodejs: HTTP Request Smuggling via Empty headers separated by CR
Summary: CVE-2023-30589 nodejs: HTTP Request Smuggling via Empty headers separated by CR
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-30589
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2220784 2220785 2220786 2220787 2220788 2220789 2220796 2220797 2220798 2220799 2220800 2220801 2223318 2223340 2223341 2223633 2223652 2223684 2223685
Blocks: 2217661
TreeView+ depends on / blocked
 
Reported: 2023-07-05 15:03 UTC by Dhananjay Arunesh
Modified: 2023-10-09 10:26 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability has been identified in the Node.js, where llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
Clone Of:
Environment:
Last Closed: 2023-08-08 13:17:02 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4330 0 None None None 2023-07-31 09:32:40 UTC
Red Hat Product Errata RHSA-2023:4331 0 None None None 2023-07-31 09:32:31 UTC
Red Hat Product Errata RHSA-2023:4536 0 None None None 2023-08-08 08:38:00 UTC
Red Hat Product Errata RHSA-2023:4537 0 None None None 2023-08-08 08:38:03 UTC
Red Hat Product Errata RHSA-2023:5361 0 None None None 2023-09-26 14:50:38 UTC
Red Hat Product Errata RHSA-2023:5533 0 None None None 2023-10-09 10:26:46 UTC

Description Dhananjay Arunesh 2023-07-05 15:03:28 UTC 
The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

References:
https://nodejs.org/en/blog/vulnerability/june-2023-security-releases
Comment 1 Dhananjay Arunesh 2023-07-06 05:31:24 UTC 
Created nodejs tracking bugs for this issue:

Affects: epel-all [bug 2220789]
Affects: fedora-all [bug 2220787]


Created nodejs:14/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220786]


Created nodejs:16-epel/nodejs tracking bugs for this issue:

Affects: epel-all [bug 2220788]


Created nodejs:16/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220785]


Created nodejs:18/nodejs tracking bugs for this issue:

Affects: fedora-all [bug 2220784]
Comment 4 errata-xmlrpc 2023-07-31 09:32:30 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4331 https://access.redhat.com/errata/RHSA-2023:4331
Comment 5 errata-xmlrpc 2023-07-31 09:32:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4330 https://access.redhat.com/errata/RHSA-2023:4330
Comment 6 errata-xmlrpc 2023-08-08 08:37:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4536 https://access.redhat.com/errata/RHSA-2023:4536
Comment 7 errata-xmlrpc 2023-08-08 08:38:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4537 https://access.redhat.com/errata/RHSA-2023:4537
Comment 8 Product Security DevOps Team 2023-08-08 13:17:00 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-30589
Comment 9 errata-xmlrpc 2023-09-26 14:50:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:5361 https://access.redhat.com/errata/RHSA-2023:5361
Comment 10 errata-xmlrpc 2023-10-09 10:26:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:5533 https://access.redhat.com/errata/RHSA-2023:5533
Note You need to log in before you can comment on or make changes to this bug.