Описание
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
A flaw was found in Axios, a promise-based HTTP client. A malicious server can exploit a state corruption bug within the HTTP/2 session cleanup logic, specifically in the Http2Sessions.getSession() method. By initiating concurrent session closures, the server can trigger a control flow error, leading to a client process crash. This vulnerability results in a Denial of Service (DoS) for the client application.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | axios | Fix deferred | ||
| Gatekeeper 3 | redhat-user-workloads/gatekeeper-3-18 | Fix deferred | ||
| Gatekeeper 3 | redhat-user-workloads/gatekeeper-3-19 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel8 | Fix deferred | ||
| Migration Toolkit for Applications 8 | mta/mta-ui-rhel9 | Fix deferred | ||
| Migration Toolkit for Applications 8 | redhat-user-workloads/art-images | Fix deferred | ||
| Migration Toolkit for Containers | redhat-user-workloads/art-images | Fix deferred | ||
| Multicluster Engine for Kubernetes | redhat-user-workloads/console-mce-mce-210 | Fix deferred | ||
| Multicluster Engine for Kubernetes | redhat-user-workloads/console-mce-mce-211 | Fix deferred | ||
| Multicluster Engine for Kubernetes | redhat-user-workloads/console-mce-mce-26 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
5.9 Medium
CVSS3
Связанные уязвимости
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.
Axios is a promise based HTTP client for the browser and Node.js. Star ...
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
5.9 Medium
CVSS3