csaf_suse - suse-su-2022:3196-1

Vulnerability from csaf_suse

Published

2022-09-08 08:35

Modified

2022-09-08 08:35

Summary

Security update for nodejs16

Notes

Title of the patch

Security update for nodejs16

Description of the patch

This update for nodejs16 fixes the following issues: - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382). - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383). - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517). - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710). Bugfixes: - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Patchnames

SUSE-2022-3196,SUSE-SLE-Module-Web-Scripting-12-2022-3196

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for nodejs16",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for nodejs16 fixes the following issues:\n\n- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).\n- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).\n- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).\n- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).\n\nBugfixes:\n\n- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2022-3196,SUSE-SLE-Module-Web-Scripting-12-2022-3196",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2022_3196-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2022:3196-1",
            url: "https://www.suse.com/support/update/announcement/2022/suse-su-20223196-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2022:3196-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2022-September/012190.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1200303",
            url: "https://bugzilla.suse.com/1200303",
         },
         {
            category: "self",
            summary: "SUSE Bug 1200517",
            url: "https://bugzilla.suse.com/1200517",
         },
         {
            category: "self",
            summary: "SUSE Bug 1201710",
            url: "https://bugzilla.suse.com/1201710",
         },
         {
            category: "self",
            summary: "SUSE Bug 1202382",
            url: "https://bugzilla.suse.com/1202382",
         },
         {
            category: "self",
            summary: "SUSE Bug 1202383",
            url: "https://bugzilla.suse.com/1202383",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-29244 page",
            url: "https://www.suse.com/security/cve/CVE-2022-29244/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-31150 page",
            url: "https://www.suse.com/security/cve/CVE-2022-31150/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-35948 page",
            url: "https://www.suse.com/security/cve/CVE-2022-35948/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2022-35949 page",
            url: "https://www.suse.com/security/cve/CVE-2022-35949/",
         },
      ],
      title: "Security update for nodejs16",
      tracking: {
         current_release_date: "2022-09-08T08:35:42Z",
         generator: {
            date: "2022-09-08T08:35:42Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2022:3196-1",
         initial_release_date: "2022-09-08T08:35:42Z",
         revision_history: [
            {
               date: "2022-09-08T08:35:42Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack16-16.17.0-8.9.1.aarch64",
                        product: {
                           name: "corepack16-16.17.0-8.9.1.aarch64",
                           product_id: "corepack16-16.17.0-8.9.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-16.17.0-8.9.1.aarch64",
                        product: {
                           name: "nodejs16-16.17.0-8.9.1.aarch64",
                           product_id: "nodejs16-16.17.0-8.9.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-devel-16.17.0-8.9.1.aarch64",
                        product: {
                           name: "nodejs16-devel-16.17.0-8.9.1.aarch64",
                           product_id: "nodejs16-devel-16.17.0-8.9.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm16-16.17.0-8.9.1.aarch64",
                        product: {
                           name: "npm16-16.17.0-8.9.1.aarch64",
                           product_id: "npm16-16.17.0-8.9.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack16-16.17.0-8.9.1.i586",
                        product: {
                           name: "corepack16-16.17.0-8.9.1.i586",
                           product_id: "corepack16-16.17.0-8.9.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-16.17.0-8.9.1.i586",
                        product: {
                           name: "nodejs16-16.17.0-8.9.1.i586",
                           product_id: "nodejs16-16.17.0-8.9.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-devel-16.17.0-8.9.1.i586",
                        product: {
                           name: "nodejs16-devel-16.17.0-8.9.1.i586",
                           product_id: "nodejs16-devel-16.17.0-8.9.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm16-16.17.0-8.9.1.i586",
                        product: {
                           name: "npm16-16.17.0-8.9.1.i586",
                           product_id: "npm16-16.17.0-8.9.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs16-docs-16.17.0-8.9.1.noarch",
                        product: {
                           name: "nodejs16-docs-16.17.0-8.9.1.noarch",
                           product_id: "nodejs16-docs-16.17.0-8.9.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack16-16.17.0-8.9.1.ppc64le",
                        product: {
                           name: "corepack16-16.17.0-8.9.1.ppc64le",
                           product_id: "corepack16-16.17.0-8.9.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-16.17.0-8.9.1.ppc64le",
                        product: {
                           name: "nodejs16-16.17.0-8.9.1.ppc64le",
                           product_id: "nodejs16-16.17.0-8.9.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-devel-16.17.0-8.9.1.ppc64le",
                        product: {
                           name: "nodejs16-devel-16.17.0-8.9.1.ppc64le",
                           product_id: "nodejs16-devel-16.17.0-8.9.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm16-16.17.0-8.9.1.ppc64le",
                        product: {
                           name: "npm16-16.17.0-8.9.1.ppc64le",
                           product_id: "npm16-16.17.0-8.9.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack16-16.17.0-8.9.1.s390x",
                        product: {
                           name: "corepack16-16.17.0-8.9.1.s390x",
                           product_id: "corepack16-16.17.0-8.9.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-16.17.0-8.9.1.s390x",
                        product: {
                           name: "nodejs16-16.17.0-8.9.1.s390x",
                           product_id: "nodejs16-16.17.0-8.9.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-devel-16.17.0-8.9.1.s390x",
                        product: {
                           name: "nodejs16-devel-16.17.0-8.9.1.s390x",
                           product_id: "nodejs16-devel-16.17.0-8.9.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm16-16.17.0-8.9.1.s390x",
                        product: {
                           name: "npm16-16.17.0-8.9.1.s390x",
                           product_id: "npm16-16.17.0-8.9.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack16-16.17.0-8.9.1.x86_64",
                        product: {
                           name: "corepack16-16.17.0-8.9.1.x86_64",
                           product_id: "corepack16-16.17.0-8.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-16.17.0-8.9.1.x86_64",
                        product: {
                           name: "nodejs16-16.17.0-8.9.1.x86_64",
                           product_id: "nodejs16-16.17.0-8.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs16-devel-16.17.0-8.9.1.x86_64",
                        product: {
                           name: "nodejs16-devel-16.17.0-8.9.1.x86_64",
                           product_id: "nodejs16-devel-16.17.0-8.9.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm16-16.17.0-8.9.1.x86_64",
                        product: {
                           name: "npm16-16.17.0-8.9.1.x86_64",
                           product_id: "npm16-16.17.0-8.9.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Web and Scripting 12",
                        product: {
                           name: "SUSE Linux Enterprise Module for Web and Scripting 12",
                           product_id: "SUSE Linux Enterprise Module for Web and Scripting 12",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-web-scripting:12",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-16.17.0-8.9.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
            },
            product_reference: "nodejs16-16.17.0-8.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-16.17.0-8.9.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
            },
            product_reference: "nodejs16-16.17.0-8.9.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-16.17.0-8.9.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
            },
            product_reference: "nodejs16-16.17.0-8.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-16.17.0-8.9.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
            },
            product_reference: "nodejs16-16.17.0-8.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-devel-16.17.0-8.9.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
            },
            product_reference: "nodejs16-devel-16.17.0-8.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-devel-16.17.0-8.9.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
            },
            product_reference: "nodejs16-devel-16.17.0-8.9.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-devel-16.17.0-8.9.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
            },
            product_reference: "nodejs16-devel-16.17.0-8.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-devel-16.17.0-8.9.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
            },
            product_reference: "nodejs16-devel-16.17.0-8.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs16-docs-16.17.0-8.9.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
            },
            product_reference: "nodejs16-docs-16.17.0-8.9.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm16-16.17.0-8.9.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
            },
            product_reference: "npm16-16.17.0-8.9.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm16-16.17.0-8.9.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
            },
            product_reference: "npm16-16.17.0-8.9.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm16-16.17.0-8.9.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
            },
            product_reference: "npm16-16.17.0-8.9.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm16-16.17.0-8.9.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
            },
            product_reference: "npm16-16.17.0-8.9.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2022-29244",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-29244",
            },
         ],
         notes: [
            {
               category: "general",
               text: "npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-29244",
               url: "https://www.suse.com/security/cve/CVE-2022-29244",
            },
            {
               category: "external",
               summary: "SUSE Bug 1200517 for CVE-2022-29244",
               url: "https://bugzilla.suse.com/1200517",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-09-08T08:35:42Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-29244",
      },
      {
         cve: "CVE-2022-31150",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-31150",
            },
         ],
         notes: [
            {
               category: "general",
               text: "undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-31150",
               url: "https://www.suse.com/security/cve/CVE-2022-31150",
            },
            {
               category: "external",
               summary: "SUSE Bug 1201710 for CVE-2022-31150",
               url: "https://bugzilla.suse.com/1201710",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-09-08T08:35:42Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-31150",
      },
      {
         cve: "CVE-2022-35948",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-35948",
            },
         ],
         notes: [
            {
               category: "general",
               text: "undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-35948",
               url: "https://www.suse.com/security/cve/CVE-2022-35948",
            },
            {
               category: "external",
               summary: "SUSE Bug 1202383 for CVE-2022-35948",
               url: "https://bugzilla.suse.com/1202383",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-09-08T08:35:42Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-35948",
      },
      {
         cve: "CVE-2022-35949",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2022-35949",
            },
         ],
         notes: [
            {
               category: "general",
               text: "undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require(\"undici\") undici.request({origin: \"http://example.com\", pathname: \"//127.0.0.1\"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2022-35949",
               url: "https://www.suse.com/security/cve/CVE-2022-35949",
            },
            {
               category: "external",
               summary: "SUSE Bug 1202382 for CVE-2022-35949",
               url: "https://bugzilla.suse.com/1202382",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-devel-16.17.0-8.9.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs16-docs-16.17.0-8.9.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm16-16.17.0-8.9.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2022-09-08T08:35:42Z",
               details: "moderate",
            },
         ],
         title: "CVE-2022-35949",
      },
   ],
}

cve-2022-35948

Vulnerability from cvelistv5

Published

2022-08-13 00:00

Modified

2024-08-03 09:51

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.

References

▼	URL	Tags
	https://github.com/nodejs/undici/releases/tag/v5.8.2
	https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3
	https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80

Impacted products

	Vendor	Product	Version
	nodejs	undici	Version: =< 5.8.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T09:51:59.082Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/releases/tag/v5.8.2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undici",
               vendor: "nodejs",
               versions: [
                  {
                     status: "affected",
                     version: "=< 5.8.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\\r\\n\\r\\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-93",
                     description: "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-74",
                     description: "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-18T00:00:00",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/nodejs/undici/releases/tag/v5.8.2",
            },
            {
               url: "https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3",
            },
            {
               url: "https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80",
            },
         ],
         source: {
            advisory: "GHSA-f772-66g8-q5h3",
            discovery: "UNKNOWN",
         },
         title: "CRLF Injection in Nodejs ‘undici’ via Content-Type",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-35948",
      datePublished: "2022-08-13T00:00:00",
      dateReserved: "2022-07-15T00:00:00",
      dateUpdated: "2024-08-03T09:51:59.082Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-35949

Vulnerability from cvelistv5

Published

2022-08-12 00:00

Modified

2024-08-03 09:51

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.

References

▼	URL	Tags
	https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3
	https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895
	https://github.com/nodejs/undici/releases/tag/v5.8.2

Impacted products

	Vendor	Product	Version
	nodejs	undici	Version: <= 5.8.1

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T09:51:59.443Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/releases/tag/v5.8.2",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undici",
               vendor: "nodejs",
               versions: [
                  {
                     status: "affected",
                     version: "<= 5.8.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require(\"undici\") undici.request({origin: \"http://example.com\", pathname: \"//127.0.0.1\"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-918",
                     description: "CWE-918: Server-Side Request Forgery (SSRF)",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-01-18T00:00:00",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               url: "https://github.com/nodejs/undici/security/advisories/GHSA-8qr4-xgw6-wmr3",
            },
            {
               url: "https://github.com/nodejs/undici/commit/124f7ebf705366b2e1844dff721928d270f87895",
            },
            {
               url: "https://github.com/nodejs/undici/releases/tag/v5.8.2",
            },
         ],
         source: {
            advisory: "GHSA-8qr4-xgw6-wmr3",
            discovery: "UNKNOWN",
         },
         title: "`undici.request` vulnerable to SSRF using absolute URL on `pathname`",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-35949",
      datePublished: "2022-08-12T00:00:00",
      dateReserved: "2022-07-15T00:00:00",
      dateUpdated: "2024-08-03T09:51:59.443Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-29244

Vulnerability from cvelistv5

Published

2022-06-13 13:40

Modified

2024-08-03 06:17

Severity ?

Summary

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.

References

▼	URL	Tags
	https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52	x_refsource_MISC
	https://github.com/npm/npm-packlist	x_refsource_MISC
	https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish	x_refsource_MISC
	https://github.com/npm/cli/tree/latest/workspaces/libnpmpack	x_refsource_MISC
	https://github.com/nodejs/node/pull/43210	x_refsource_MISC
	https://github.com/npm/cli/releases/tag/v8.11.0	x_refsource_MISC
	https://github.com/nodejs/node/releases/tag/v16.15.1	x_refsource_MISC
	https://github.com/nodejs/node/releases/tag/v17.9.1	x_refsource_MISC
	https://github.com/nodejs/node/releases/tag/v18.3.0	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220722-0007/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	npm	npm	Version: 7.9.0 < 7.9.0* Version: 8.11.0 < 8.11.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T06:17:54.265Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/npm-packlist",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpack",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/node/pull/43210",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/npm/cli/releases/tag/v8.11.0",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/node/releases/tag/v16.15.1",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/node/releases/tag/v17.9.1",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/node/releases/tag/v18.3.0",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220722-0007/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "npm",
               vendor: "npm",
               versions: [
                  {
                     lessThan: "7.9.0*",
                     status: "affected",
                     version: "7.9.0",
                     versionType: "custom",
                  },
                  {
                     lessThan: "8.11.0",
                     status: "affected",
                     version: "8.11.0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200 Information Exposure",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-22T18:09:17",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/npm-packlist",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpack",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/node/pull/43210",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/npm/cli/releases/tag/v8.11.0",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/node/releases/tag/v16.15.1",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/node/releases/tag/v17.9.1",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/node/releases/tag/v18.3.0",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220722-0007/",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "npm packing does not respect root-level ignore files in workspaces",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2022-29244",
               STATE: "PUBLIC",
               TITLE: "npm packing does not respect root-level ignore files in workspaces",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "npm",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: ">=",
                                          version_name: "7.9.0",
                                          version_value: "7.9.0",
                                       },
                                       {
                                          version_affected: "<",
                                          version_name: "8.11.0",
                                          version_value: "8.11.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "npm",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.",
                  },
               ],
            },
            generator: {
               engine: "Vulnogram 0.0.9",
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200 Information Exposure",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52",
                     refsource: "MISC",
                     url: "https://github.com/npm/cli/security/advisories/GHSA-hj9c-8jmm-8c52",
                  },
                  {
                     name: "https://github.com/npm/npm-packlist",
                     refsource: "MISC",
                     url: "https://github.com/npm/npm-packlist",
                  },
                  {
                     name: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish",
                     refsource: "MISC",
                     url: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpublish",
                  },
                  {
                     name: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpack",
                     refsource: "MISC",
                     url: "https://github.com/npm/cli/tree/latest/workspaces/libnpmpack",
                  },
                  {
                     name: "https://github.com/nodejs/node/pull/43210",
                     refsource: "MISC",
                     url: "https://github.com/nodejs/node/pull/43210",
                  },
                  {
                     name: "https://github.com/npm/cli/releases/tag/v8.11.0",
                     refsource: "MISC",
                     url: "https://github.com/npm/cli/releases/tag/v8.11.0",
                  },
                  {
                     name: "https://github.com/nodejs/node/releases/tag/v16.15.1",
                     refsource: "MISC",
                     url: "https://github.com/nodejs/node/releases/tag/v16.15.1",
                  },
                  {
                     name: "https://github.com/nodejs/node/releases/tag/v17.9.1",
                     refsource: "MISC",
                     url: "https://github.com/nodejs/node/releases/tag/v17.9.1",
                  },
                  {
                     name: "https://github.com/nodejs/node/releases/tag/v18.3.0",
                     refsource: "MISC",
                     url: "https://github.com/nodejs/node/releases/tag/v18.3.0",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220722-0007/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220722-0007/",
                  },
               ],
            },
            source: {
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-29244",
      datePublished: "2022-06-13T13:40:27",
      dateReserved: "2022-04-13T00:00:00",
      dateUpdated: "2024-08-03T06:17:54.265Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-31150

Vulnerability from cvelistv5

Published

2022-07-19 20:40

Modified

2024-08-03 07:11

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.

References

▼	URL	Tags
	https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc	x_refsource_CONFIRM
	https://hackerone.com/reports/409943	x_refsource_MISC
	https://github.com/nodejs/undici/releases/tag/v5.8.0	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20220915-0002/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	nodejs	undici	Version: < v5.7.1, >= v5.8.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T07:11:39.394Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://hackerone.com/reports/409943",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/undici/releases/tag/v5.8.0",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220915-0002/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undici",
               vendor: "nodejs",
               versions: [
                  {
                     status: "affected",
                     version: "< v5.7.1, >= v5.8.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-93",
                     description: "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-09-15T17:06:42",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://hackerone.com/reports/409943",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/nodejs/undici/releases/tag/v5.8.0",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220915-0002/",
            },
         ],
         source: {
            advisory: "GHSA-3cvr-822r-rqcc",
            discovery: "UNKNOWN",
         },
         title: "CRLF injection in request headers",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security-advisories@github.com",
               ID: "CVE-2022-31150",
               STATE: "PUBLIC",
               TITLE: "CRLF injection in request headers",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "undici",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "< v5.7.1, >= v5.8.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "nodejs",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\\r\\n` is a workaround for this issue.",
                  },
               ],
            },
            impact: {
               cvss: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc",
                     refsource: "CONFIRM",
                     url: "https://github.com/nodejs/undici/security/advisories/GHSA-3cvr-822r-rqcc",
                  },
                  {
                     name: "https://hackerone.com/reports/409943",
                     refsource: "MISC",
                     url: "https://hackerone.com/reports/409943",
                  },
                  {
                     name: "https://github.com/nodejs/undici/releases/tag/v5.8.0",
                     refsource: "MISC",
                     url: "https://github.com/nodejs/undici/releases/tag/v5.8.0",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220915-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220915-0002/",
                  },
               ],
            },
            source: {
               advisory: "GHSA-3cvr-822r-rqcc",
               discovery: "UNKNOWN",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2022-31150",
      datePublished: "2022-07-19T20:40:10",
      dateReserved: "2022-05-18T00:00:00",
      dateUpdated: "2024-08-03T07:11:39.394Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2022-35948

Vulnerability from cvelistv5

cve-2022-35949

Vulnerability from cvelistv5

cve-2022-29244

Vulnerability from cvelistv5

cve-2022-31150

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature