Bug 2339176 (CVE-2025-22150)

Summary:	CVE-2025-22150 undici: Undici Uses Insufficiently Random Values
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, anpicker, asoldano, bbaranow, bmaxwell, bparees, brian.stansberry, cdaley, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, fjuma, gkamathe, hasun, istudens, ivassile, iweiss, jchui, jforrest, jfula, jhe, jkoehler, jowilson, jwong, kshier, ktsao, lgao, lphiri, mosmerov, msochure, msvehla, nboldt, nwallace, nyancey, ometelka, pesilva, pjindal, pmackay, psrna, ptisnovs, rstancel, sdawley, smaestri, stcannon, syedriko, tom.jenkinson, xdharmai
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the undici package for Node.js. Undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If an app has a mechanism that sends multipart requests to an attacker-controlled website, it can leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-01-21 18:01:49 UTC

Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mechanism in an app that sends multipart requests to an attacker-controlled website, they can use this to leak the necessary values. Therefore, an attacker can tamper with the requests going to the backend APIs if certain conditions are met. This is fixed in versions 5.28.5, 6.21.1, and 7.2.3. As a workaround, do not issue multipart requests to attacker controlled servers.

Comment 3 errata-xmlrpc 2025-02-12 15:23:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:1351 https://access.redhat.com/errata/RHSA-2025:1351

Comment 4 errata-xmlrpc 2025-02-13 15:36:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:1443 https://access.redhat.com/errata/RHSA-2025:1443

Comment 5 errata-xmlrpc 2025-02-13 15:58:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:1446 https://access.redhat.com/errata/RHSA-2025:1446

Comment 6 errata-xmlrpc 2025-02-13 16:37:12 UTC

This issue has been addressed in the following products:

  Red Hat Developer Hub 1.3 on RHEL 9

Via RHSA-2025:1454 https://access.redhat.com/errata/RHSA-2025:1454

Comment 7 errata-xmlrpc 2025-02-17 12:43:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:1582 https://access.redhat.com/errata/RHSA-2025:1582

Comment 8 errata-xmlrpc 2025-02-17 17:57:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:1611 https://access.redhat.com/errata/RHSA-2025:1611

Comment 9 errata-xmlrpc 2025-02-17 19:17:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:1613 https://access.redhat.com/errata/RHSA-2025:1613