Описание
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Отчет
The nodejs RPMs shipped in Red Hat OpenShift Container Platform (OCP) versions 3.6 through 3.10 are vulnerable to this flaw because they contain the affected code. Later versions of OCP used nodejs RPMs delivered from Red Hat Software Collections and Red Hat Enterprise Linux channels.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | nodejs | Not affected | ||
| Red Hat OpenShift Application Runtimes | nodejs | Not affected | ||
| Red Hat OpenShift Container Platform 3.10 | nodejs | Fix deferred | ||
| Red Hat OpenShift Container Platform 3.2 | nodejs | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.3 | nodejs | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.4 | nodejs | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.5 | nodejs | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.6 | nodejs | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.7 | nodejs | Out of support scope | ||
| Red Hat OpenShift Container Platform 3.9 | nodejs | Fix deferred |
Показывать по
Дополнительная информация
Статус:
7.2 High
CVSS3
Связанные уязвимости
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request ...
Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
7.2 High
CVSS3