BIT-node-2023-23936
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/node/BIT-node-2023-23936.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-node-2023-23936
- Aliases
- Published
- 2024-03-06T11:01:51.693Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect
hostHTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize theheaders.hoststring before passing to undici. - References
Affected packages
Bitnami / node
Package
- Name
- node
- Purl
- pkg:bitnami/node
Severity
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator