Описание
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| nodejs | fixed | 10.19.0~dfsg-1 | package | |
| nodejs | ignored | stretch | package | |
| nodejs | end-of-life | jessie | package |
Примечания
https://hackerone.com/reports/730779
https://github.com/nodejs/node/commit/2eee90e959ca4abaf53caf238d063c396f2ea17c (v10.19.0)
EPSS
Связанные уязвимости
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
Уязвимость программной платформы Node.js, связанная с недостаточной проверкой вводимых данных при обработке заголовков HTTP, позволяющая нарушителю получить полный контроль над приложением
EPSS