UBUNTU-CVE-2023-30589

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-30589
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-30589.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2023-30589
Related
Published
2023-07-01T00:15:00Z
Modified
2023-07-01T00:15:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

References

Affected packages

Ubuntu:24.04:LTS / nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
18.19.1+dfsg-2ubuntu4

Affected versions

18.*

18.13.0+dfsg1-1ubuntu2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode-dev"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "libnode108-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-dbgsym"
        },
        {
            "binary_version": "18.19.1+dfsg-2ubuntu4",
            "binary_name": "nodejs-doc"
        }
    ]
}