CVE-2023-24807
Summary
| CVE | CVE-2023-24807 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-02-16 18:15:00 UTC |
| Updated | 2023-02-24 18:38:00 UTC |
| Description | Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available. |
Risk And Classification
Problem Types: CWE-1333
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Regular Expression Denial of Service in Headers · Advisory · nodejs/undici · GitHub | MISC | github.com | |
| Just a moment... | MISC | hackerone.com | |
| Release v5.19.1 · nodejs/undici · GitHub | MISC | github.com | |
| Merge pull request from GHSA-r6ch-mqf9-qc9w · nodejs/undici@f2324e5 · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160533 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-1583)
- 160535 Oracle Enterprise Linux Security Update for nodejs:16 (ELSA-2023-1582)
- 160639 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-2654)
- 160640 Oracle Enterprise Linux Security Update for nodejs and nodejs-nodemon (ELSA-2023-2655)
- 241307 Red Hat Update for nodejs:18 security (RHSA-2023:1583)
- 241332 Red Hat Update for nodejs:16 security (RHSA-2023:1582)
- 241429 Red Hat Update for nodejs and nodejs-nodemon security (RHSA-2023:2655)
- 241457 Red Hat Update for nodejs:18 security (RHSA-2023:2654)
- 242132 Red Hat Update for nodejs security (RHSA-2023:5533)
- 284203 Fedora Security Update for nodejs16 (FEDORA-2023-973319d5b7)
- 502670 Alpine Linux Security Update for nodejs
- 502748 Alpine Linux Security Update for nodejs
- 753756 SUSE Enterprise Linux Security Update for nodejs16 (SUSE-SU-2023:0673-1)
- 905571 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13585)
- 906674 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (13585-3)
- 940976 AlmaLinux Security Update for nodejs:16 (ALSA-2023:1582)
- 940977 AlmaLinux Security Update for nodejs:18 (ALSA-2023:1583)
- 941013 AlmaLinux Security Update for nodejs and nodejs-nodemon (ALSA-2023:2655)
- 941014 AlmaLinux Security Update for nodejs:18 (ALSA-2023:2654)
- 960893 Rocky Linux Security Update for nodejs:18 (RLSA-2023:1583)
- 960902 Rocky Linux Security Update for nodejs:16 (RLSA-2023:1582)
- 960937 Rocky Linux Security Update for nodejs and nodejs-nodemon (RLSA-2023:2655)