Bug 2130518 (CVE-2022-35256)
| Summary: | CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | TEJ RATHI <trathi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | caswilli, drieden, fjansen, hhorak, ikanias, jary, jhouska, jkoehler, jorton, kaycoth, mrunge, mvanderw, nodejs-maint, nodejs-sig, rravi, sgallagh, thrcka, tohughes, zsvetlik |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | NodeJS 14.20.1, Nodejs 16.17.1, Nodejs 18.9.1, llhttp 6.0.10 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in NodeJS due to improper validation of HTTP requests. The llhttp parser in the HTTP module in Node.js does not correctly handle header fields that are not terminated with CLRF. This issue may result in HTTP Request Smuggling. This flaw allows a remote attacker to send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-12-04 07:33:15 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2130533, 2130534, 2130536, 2130532, 2130537, 2130538, 2130539, 2130540, 2130541, 2130569, 2130570, 2130571, 2130572, 2130573, 2130574, 2131745, 2131746, 2131747, 2131748, 2131749, 2131750, 2132003, 2132004, 2132732 | ||
| Bug Blocks: | 2130576 | ||
|
Description
TEJ RATHI
2022-09-28 13:14:24 UTC
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 2130533] Affects: fedora-all [bug 2130532] Created nodejs:12/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2130537] Created nodejs:13/nodejs tracking bugs for this issue: Affects: epel-all [bug 2130534] Created nodejs:14/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2130538] Created nodejs:15/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2130539] Created nodejs:16-epel/nodejs tracking bugs for this issue: Affects: epel-all [bug 2130536] Created nodejs:16/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2130540] Created nodejs:18/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2130541] This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:6963 https://access.redhat.com/errata/RHSA-2022:6963 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:6964 https://access.redhat.com/errata/RHSA-2022:6964 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2022:7044 https://access.redhat.com/errata/RHSA-2022:7044 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7821 https://access.redhat.com/errata/RHSA-2022:7821 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:7830 https://access.redhat.com/errata/RHSA-2022:7830 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-35256 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:0321 https://access.redhat.com/errata/RHSA-2023:0321 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2023:1533 https://access.redhat.com/errata/RHSA-2023:1533 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2023:1742 https://access.redhat.com/errata/RHSA-2023:1742 |