CVE-2023-30589
Summary
| CVE | CVE-2023-30589 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-07-01 00:15:00 UTC |
| Updated | 2023-12-12 14:33:00 UTC |
| Description | The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 37 | All | All | All |
| Operating System | Fedoraproject | Fedora | 38 | All | All | All |
| Application | Nodejs | Node.js | All | All | All | All |
| Application | Nodejs | Node.js | 16.0.0 | All | All | All |
| Application | Nodejs | Node.js | 18.0.0 | All | All | All |
| Application | Nodejs | Node.js | 20.0.0 | All | All | All |
| Application | Nodejs | Node.js | 20.2.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| HackerOne | MISC | hackerone.com | |
| [SECURITY] Fedora 37 Update: nodejs18-18.16.1-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 38 Update: python-aiohttp-3.8.5-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: python-aiohttp-3.8.5-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | |
| [SECURITY] Fedora 38 Update: nodejs16-16.20.1-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | Mailing List |
| CVE-2023-30589 Node.js Vulnerability in NetApp Products | NetApp Product Security | MISC | security.netapp.com | |
| [SECURITY] Fedora 38 Update: nodejs18-18.16.1-1.fc38 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | Mailing List |
| [SECURITY] Fedora 37 Update: nodejs16-16.20.1-1.fc37 - package-announce - Fedora Mailing-Lists | MISC | lists.fedoraproject.org | Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160824 Oracle Enterprise Linux Security Update for 18 (ELSA-2023-4330)
- 160835 Oracle Enterprise Linux Security Update for nodejs (ELSA-2023-4331)
- 160852 Oracle Enterprise Linux Security Update for nodejs:16 (ELSA-2023-4537)
- 160853 Oracle Enterprise Linux Security Update for nodejs:18 (ELSA-2023-4536)
- 241874 Red Hat Update for nodejs security (RHSA-2023:4331)
- 241876 Red Hat Update for nodejs:18 security (RHSA-2023:4330)
- 241930 Red Hat Update for nodejs:16 security (RHSA-2023:4537)
- 241939 Red Hat Update for nodejs:18 security (RHSA-2023:4536)
- 242085 Red Hat Update for nodejs:16 security (RHSA-2023:5361)
- 242132 Red Hat Update for nodejs security (RHSA-2023:5533)
- 284323 Fedora Security Update for nodejs18 (FEDORA-2023-6b866fbe84)
- 284328 Fedora Security Update for nodejs16 (FEDORA-2023-61e40652be)
- 284329 Fedora Security Update for nodejs16 (FEDORA-2023-608a1417d3)
- 284330 Fedora Security Update for nodejs18 (FEDORA-2023-cdddce304a)
- 284370 Fedora Security Update for llhttp (FEDORA-2023-f75af676f2)
- 284409 Fedora Security Update for llhttp (FEDORA-2023-105880e618)
- 285303 Fedora Security Update for llhttp (FEDORA-2023-ad76deb86e)
- 355624 Amazon Linux Security Advisory for nodejs : ALAS2023-2023-237
- 378945 Oracle Java Standard Edition (SE) Critical Patch Update - October 2023 (CPUOCT2023)
- 379452 IBM Cognos Analytics Multiple Vulnerabilities (7123154)
- 503428 Alpine Linux Security Update for openjdk17
- 506138 Alpine Linux Security Update for openjdk17
- 6000404 Debian Security Update for nodejs (DSA 5589-1)
- 754181 SUSE Enterprise Linux Security Update for nodejs16 (SUSE-SU-2023:2861-1)
- 907096 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs (27278-1)
- 907331 Common Base Linux Mariner (CBL-Mariner) Security Update for nodejs18 (27279-1)
- 941202 AlmaLinux Security Update for nodejs:18 (ALSA-2023:4330)
- 941203 AlmaLinux Security Update for nodejs (ALSA-2023:4331)
- 941221 AlmaLinux Security Update for nodejs:16 (ALSA-2023:4537)
- 941222 AlmaLinux Security Update for nodejs:18 (ALSA-2023:4536)
- 960969 Rocky Linux Security Update for nodejs:16 (RLSA-2023:4537)
- 961042 Rocky Linux Security Update for nodejs:18 (RLSA-2023:4536)