Описание
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.
Отчет
This flaw affects applications that use undici's shared-cache interceptor (interceptors.cache(), type: 'shared', which is the default) against untrusted or multi-tenant upstream servers. In that configuration, undici stores and re-serves the Set-Cookie header of cached responses, allowing one user's session cookie to be disclosed to another caller that hits the same cache key, and allowing a malicious upstream to inject cookies into responses served to other users. Applications that only use undici as an HTTP client without enabling the shared cache interceptor, or that only use the private cache mode, are not affected. Red Hat products that bundle undici versions prior to 7.0.0 (5.x/6.x lines) are not affected, as the vulnerable cache interceptor was introduced in undici 7.0.0.
Меры по смягчению последствий
Upgrade to undici 7.29.1 or 8.10.2 (or later), where the shared cache interceptor no longer stores or re-serves responses containing Set-Cookie. Where an immediate upgrade is not possible: use a private cache (type: 'private') for per-user responses instead of the shared cache; avoid caching responses that carry a Set-Cookie header; or, if your service itself acts as a shared cache in front of an untrusted origin, strip Set-Cookie from upstream responses before caching them.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence/vulnerability-analysis-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-pf5-rhel9 | Fix deferred | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel9 | Fix deferred | ||
| Red Hat AMQ Broker 7 | amq-broker-bin.zip | Not affected | ||
| Red Hat AMQ Broker 7 | amq-broker-maven-repository.zip | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Not affected | ||
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Fix deferred | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend | Fix deferred | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend | Fix deferred | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
(undici's cache interceptor does not handle the Set-Cookie response hea ...)
undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a public and max-age directive, is stored and then re-served to a later caller that matches the same cache key. As a result one caller's cookie is disclosed to a different caller, and an untrusted server can inject cookies into cached responses served to all subsequent callers. This violates the requirement that a shared cache must not store cookies. This affects undici versions from 7.0.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.
undici's cache interceptor does not handle the Set-Cookie response hea ...
EPSS
6.5 Medium
CVSS3