← Voltar para CVEs

CVE-2023-24807

HIGH

7.5

Descricao

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado2/16/2023

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

nodejs:undici

Fraquezas (CWE)

CWE-20CWE-1333

Referencias

https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf(security-advisories@github.com)

https://github.com/nodejs/undici/releases/tag/v5.19.1(security-advisories@github.com)

https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w(security-advisories@github.com)

https://hackerone.com/bugs?report_id=1784449(security-advisories@github.com)

https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nodejs/undici/releases/tag/v5.19.1(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/bugs?report_id=1784449(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20230324-0010/(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.