CVE-2023-30589
CVE-2023-30589
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
CVSS 7.5 · Élevée · EPSS 3,9% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system · node
Produits et versions concernés
node.js
- Versions du logiciel
- ≥ 4.0, < 4.*: Concernée (semver)
- ≥ 5.0, < 5.*: Concernée (semver)
- ≥ 6.0, < 6.*: Concernée (semver)
- ≥ 7.0, < 7.*: Concernée (semver)
- ≥ 8.0, < 8.*: Concernée (semver)
- ≥ 9.0, < 9.*: Concernée (semver)
- ≥ 10.0, < 10.*: Concernée (semver)
- ≥ 11.0, < 11.*: Concernée (semver)
- ≥ 12.0, < 12.*: Concernée (semver)
- ≥ 13.0, < 13.*: Concernée (semver)
- ≥ 14.0, < 14.*: Concernée (semver)
- ≥ 15.0, < 15.*: Concernée (semver)
- ≥ 16.0, < 16.20.1: Concernée (semver)
- ≥ 17.0, < 17.*: Concernée (semver)
- ≥ 18.0, < 18.16.1: Concernée (semver)
- ≥ 19.0, < 19.*: Concernée (semver)
- ≥ 20.0, < 20.3.1: Concernée (semver)
Mettez à jour vers 16.20.1; Mettez à jour vers 18.16.1; Mettez à jour vers 20.3.1
nodejs Debian:12
- Versions du logiciel
- 18.13.0+dfsg1-1
- 18.13.0+dfsg1-1.1
- 18.19.0+dfsg-1
- 18.19.0+dfsg-2
- 18.19.0+dfsg-3
- 18.19.0+dfsg-4
- 18.19.0+dfsg-5
- Plages de versions concernées
- ECOSYSTEM: < 18.19.0+dfsg-6~deb12u1
Mettez à jour vers 18.19.0+dfsg-6~deb12u1
nodejs Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 18.13.0+dfsg1-1.1
Mettez à jour vers 18.13.0+dfsg1-1.1
nodejs Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 18.13.0+dfsg1-1.1
Mettez à jour vers 18.13.0+dfsg1-1.1
llhttp npm
- Plages de versions concernées
- SEMVER: < 8.1.1
Mettez à jour vers 8.1.1
Sources originales
- https://hackerone.com/reports/2001873
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VEEQIN5242K5NBE2CZ4DYTNA5B4YTYE5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UEJWL67XR67JAGEL2ZK22NA3BRKNMZNY/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VKFMKD4MJZIKFQJAAJ4VZ2FHIJ764A76/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HMEELCREWMRT6NS7HWXLA6XFLLMO36HE/
- https://security.netapp.com/advisory/ntap-20230803-0009/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VCVG4TQRGTK4LKAZKVEQAUEJM7DUACYE/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IV326O2X4BE3SINX5FJHMAKVHUAA4ZYF/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00029.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-30589