Bug 2273519 (CVE-2024-30261)

Summary:	CVE-2024-30261 nodejs-undici: fetch() with integrity option is too lax when algorithm is specified but hash value is in incorrect
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abarbaro, asoldano, bbaranow, bmaxwell, brian.stansberry, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, fjuma, gkamathe, istudens, ivassile, iweiss, jchui, jhe, ktsao, lgao, mosmerov, msochure, mstefank, msvehla, nboldt, nwallace, pesilva, pjindal, pmackay, psrna, rstancel, rtaniwa, sdawley, smaestri, tkral, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	undici 5.28.4, undici 6.11.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the nodejs-undici package. This issue may allow an attacker to alter the integrity option passed to fetch(), allowing fetch() to accept requests as valid even if they have been tampered with.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2273521
Bug Blocks:	2273518

Description Robb Gatica 2024-04-04 20:02:32 UTC

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

https://github.com/nodejs/undici/commit/2b39440bd9ded841c93dd72138f3b1763ae26055
https://github.com/nodejs/undici/commit/d542b8cd39ec1ba303f038ea26098c3f355974f3
https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
https://hackerone.com/reports/2377760

Comment 1 Robb Gatica 2024-04-04 20:06:37 UTC

Created nodejs-undici tracking bugs for this issue:

Affects: fedora-all [bug 2273521]