CVE-2023-23936
Summary
| CVE | CVE-2023-23936 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-02-16 18:15:00 UTC |
| Updated | 2023-02-24 19:14:00 UTC |
| Description | Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici. |
Risk And Classification
Problem Types: CWE-74
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Just a moment... | MISC | hackerone.com | |
| Merge pull request from GHSA-5r9g-qh6m-jxff · nodejs/undici@a2eff05 · GitHub | MISC | github.com | |
| Release v5.19.1 · nodejs/undici · GitHub | MISC | github.com | |
| CRLF Injection in Nodejs ‘undici’ via host · Advisory · nodejs/undici · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160533 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-1583)
- 160535 Oracle Enterprise Linux Security Update for nodejs:16 (ELSA-2023-1582)
- 160639 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-2654)
- 160640 Oracle Enterprise Linux Security Update for nodejs and nodejs-nodemon (ELSA-2023-2655)
- 241307 Red Hat Update for nodejs:18 security (RHSA-2023:1583)
- 241332 Red Hat Update for nodejs:16 security (RHSA-2023:1582)
- 241429 Red Hat Update for nodejs and nodejs-nodemon security (RHSA-2023:2655)
- 241457 Red Hat Update for nodejs:18 security (RHSA-2023:2654)
- 242132 Red Hat Update for nodejs security (RHSA-2023:5533)
- 284203 Fedora Security Update for nodejs16 (FEDORA-2023-973319d5b7)
- 502670 Alpine Linux Security Update for nodejs
- 502748 Alpine Linux Security Update for nodejs
- 753756 SUSE Enterprise Linux Security Update for nodejs16 (SUSE-SU-2023:0673-1)
- 905574 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13604)
- 906673 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13604-3)
- 940976 AlmaLinux Security Update for nodejs:16 (ALSA-2023:1582)
- 940977 AlmaLinux Security Update for nodejs:18 (ALSA-2023:1583)
- 941013 AlmaLinux Security Update for nodejs and nodejs-nodemon (ALSA-2023:2655)
- 941014 AlmaLinux Security Update for nodejs:18 (ALSA-2023:2654)
- 960893 Rocky Linux Security Update for nodejs:18 (RLSA-2023:1583)
- 960902 Rocky Linux Security Update for nodejs:16 (RLSA-2023:1582)
- 960937 Rocky Linux Security Update for nodejs and nodejs-nodemon (RLSA-2023:2655)