Bug 2060020 (CVE-2022-0691)

Summary:	CVE-2022-0691 npm-url-parse: authorization bypass through user-controlled key
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aos-bugs, bdettelb, caswilli, dwhatley, dymurray, gparvin, ibolton, jkoehler, jmatthew, jmontleo, jramanat, jwendell, kaycoth, michal.skrivanek, mperina, njean, ovanders, pahickey, rcernich, rfreiman, slucidi, sseago, stcannon, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	url-parse 1.5.9	Doc Type:	If docs needed, set a value
Doc Text:	An authorization bypass flaw was found in url-parse. This flaw allows a local unauthenticated attacker to add a backspace character (\b) while submitting a URL. This vulnerability can enable bypassing any hostname checks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-11-25 15:54:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2060936, 2060939, 2060941, 2110613, 2110614, 2110859
Bug Blocks:	2057443

Description Marian Rehak 2022-03-02 14:24:46 UTC

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Reference:

https://github.com/unshiftio/url-parse/commit/0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63
https://huntr.dev/bounties/57124ed5-4b68-4934-8325-2c546257f2e4

Comment 2 juneau 2022-03-04 15:55:28 UTC

services affected per following:

services-ccx/advisor-frontend:a764354/url-parse-1.5.1 https://github.com/RedHatInsights/ocp-advisor-frontend/blob/prod-stable/package-lock.json

services-management-platform/frontend-starter-app/frontend-starter-app:2b2ef7d/url-parse-1.5.1 https://github.com/RedHatInsights/sed-frontend/blob/master/package-lock.json

services-rhods/rhods/jupyterhub-odh:64e363a/url-parse-1.4.7 https://github.com/red-hat-data-services/jupyterhub-odh/blob/master/package-lock.json

services-rhcert/rhcert-spa:c8824a1/url-parse-1.5.3 https://gitlab.cee.redhat.com/certification/rhcert-spa/blob/master/package-lock.json
services-rhcert/rhcert-spa:c8824a1/url-parse-1.5.3 https://gitlab.cee.redhat.com/certification/rhcert-spa/blob/master/yarn.lock

services-assisted-installer/facet:11c368f/url-parse-1.5.3 https://github.com/openshift-assisted/assisted-ui/blob/master/yarn.lock

Comment 7 errata-xmlrpc 2022-09-13 00:58:30 UTC

This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.7

Via RHSA-2022:6429 https://access.redhat.com/errata/RHSA-2022:6429

Comment 8 Product Security DevOps Team 2022-11-25 15:54:34 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-0691