CVE-2020-8287

Опубликовано: 06 янв. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 6.4

EPSS Низкий

Описание

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://hackerone.com/reports/1002188
Exploit
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00009.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/
https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
Patch
Vendor Advisory
https://security.gentoo.org/glsa/202101-07
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210212-0003/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4826
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
Patch
Third Party Advisory
https://hackerone.com/reports/1002188
Exploit
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00009.html
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4I6MZNC7C7VIDQR267OL4TVCI3ZKAC4/
https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/
Patch
Vendor Advisory
https://security.gentoo.org/glsa/202101-07
Third Party Advisory
https://security.netapp.com/advisory/ntap-20210212-0003/
Third Party Advisory
https://www.debian.org/security/2021/dsa-4826
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 10.0.0 (включая) до 10.23.1 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 12.0.0 (включая) до 12.20.1 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Версия от 14.0.0 (включая) до 14.15.4 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

Версия от 15.0.0 (включая) до 15.5.1 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:*

Конфигурация 5

cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Версия до 1.0.1.1 (исключая)

EPSS

Процентиль: 93%

0.09757

Низкий

6.5 Medium

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-444

Связанные уязвимости

CVE-2020-8287

CVSS3: 6.5

ubuntu

больше 4 лет назад

CVE-2020-8287

CVSS3: 5.4

redhat

больше 4 лет назад

CVE-2020-8287

CVSS3: 6.5

debian

больше 4 лет назад

Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two co ...

openSUSE-SU-2021:0195-1

suse-cvrf

больше 4 лет назад

Security update for nodejs8

SUSE-SU-2021:0224-1

suse-cvrf

больше 4 лет назад

Security update for nodejs8

EPSS

Процентиль: 93%

0.09757

Низкий

6.5 Medium

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-444