Описание
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.
Отчет
This flaw only affects applications that construct an undici BalancedPool with a function-valued connect or tls option — for example, a custom checkServerIdentity callback or connector used for certificate pinning across multiple upstreams. Client, Pool, Agent, and RoundRobinPool destructure these options before the internal JSON-based clone and are not affected. An attacker able to present, on the network path, a TLS endpoint whose certificate the application's custom validator was written to reject — but which still satisfies Node.js's default hostname and chain checks — can have that certificate silently accepted when the connection goes through BalancedPool, enabling a man-in-the-middle attack against affected connections. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2.
Меры по смягчению последствий
Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line).
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence/vulnerability-analysis-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-pf5-rhel9 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel9 | Affected | ||
| Red Hat AMQ Broker 7 | amq-broker-bin.zip | Not affected | ||
| Red Hat AMQ Broker 7 | amq-broker-maven-repository.zip | Not affected | ||
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Not affected | ||
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Affected | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend | Affected | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend | Affected | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
(undici's BalancedPool constructor passes its entire options object thr ...)
undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application's custom checkServerIdentity was written to reject, but which still passes Node's default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.
undici's BalancedPool constructor passes its entire options object thr ...
EPSS
7.4 High
CVSS3