UBUNTU-CVE-2023-30589

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2023-30589

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-30589.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-30589

Related

Published

2023-07-01T00:15:00Z

Modified

2023-07-01T00:15:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

[none]

Details

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

References

Affected packages

Ubuntu:24.04:LTS / nodejs

Package

Name: nodejs
Purl: pkg:deb/ubuntu/nodejs@18.19.1+dfsg-2ubuntu4?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

18.19.1+dfsg-2ubuntu4

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "libnode108": "18.19.1+dfsg-2ubuntu4",
            "libnode108-dbgsym": "18.19.1+dfsg-2ubuntu4",
            "nodejs": "18.19.1+dfsg-2ubuntu4",
            "libnode-dev": "18.19.1+dfsg-2ubuntu4",
            "nodejs-doc": "18.19.1+dfsg-2ubuntu4",
            "nodejs-dbgsym": "18.19.1+dfsg-2ubuntu4"
        }
    ]
}