Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:3835-1

Опубликовано: 01 нояб. 2022
Источник: suse-cvrf

Описание

Security update for nodejs10

This update for nodejs10 fixes the following issues:

  • CVE-2022-35256: Fixed incorrect parsing of header fields (bsc#1203832).
  • CVE-2022-32213: Fixed bypass via obs-fold mechanic (bsc#1201325).

Список пакетов

openSUSE Leap 15.3
nodejs10-10.24.1-150000.1.50.1
nodejs10-devel-10.24.1-150000.1.50.1
nodejs10-docs-10.24.1-150000.1.50.1
npm10-10.24.1-150000.1.50.1
openSUSE Leap 15.4
nodejs10-10.24.1-150000.1.50.1
nodejs10-devel-10.24.1-150000.1.50.1
nodejs10-docs-10.24.1-150000.1.50.1
npm10-10.24.1-150000.1.50.1

Ссылки

Описание

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Затронутые продукты
openSUSE Leap 15.3:nodejs10-10.24.1-150000.1.50.1
openSUSE Leap 15.3:nodejs10-devel-10.24.1-150000.1.50.1
openSUSE Leap 15.3:nodejs10-docs-10.24.1-150000.1.50.1
openSUSE Leap 15.3:npm10-10.24.1-150000.1.50.1
Ссылки

Описание

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Затронутые продукты
openSUSE Leap 15.3:nodejs10-10.24.1-150000.1.50.1
openSUSE Leap 15.3:nodejs10-devel-10.24.1-150000.1.50.1
openSUSE Leap 15.3:nodejs10-docs-10.24.1-150000.1.50.1
openSUSE Leap 15.3:npm10-10.24.1-150000.1.50.1
Ссылки