CVE-2023-23936

🗓️ 16 Feb 2023 17:30:23Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 303 Views

Undici HTTP/1.1 client for Node.js has CRLF injection vulnerability prior to v5.19.1

Reporter	Title	Published	Views	Family All 150
ALT Linux	Security fix for the ALT Linux 10 package node version 16.19.1-alt1	22 Mar 202300:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM Cognos Controller is affected by vulnerabilities	15 Apr 202503:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® Graph	24 Apr 202322:02	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM SDK for Node.js and packaged modules affect IBM Business Automation Workflow Configuration Editor	1 Mar 202309:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities in Node.js (CVE-2022-43548, CVE-2020-7676, CVE-2021-42550, CVE-2021-38561, CVE-2022-32149)	22 Jun 202320:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js	28 Jun 202320:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to multiple vulnerabilities	2 Oct 202410:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	20 Oct 202317:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js	3 Apr 202315:27	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Node.js affects IBM Voice Gateway	20 Mar 202314:40	–	ibm

NVD

Vulners

Node

nodejs node.jsRange16.0.0–16.19.1lts

nodejs node.jsRange18.0.0–18.14.1lts

nodejs node.jsRange19.0.0–19.6.1-

nodejs undiciRange2.0.0–5.19.1node.js

[
  {
    "vendor": "nodejs",
    "product": "undici",
    "versions": [
      {
        "version": ">=2.0.0, < 5.19.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/1820955
github	www.github.com/nodejs/undici/commit/a2eff05401358f6595138df963837c24348f2034
github	www.github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff
github	www.github.com/nodejs/undici/releases/tag/v5.19.1

21 Nov 2024 07:47Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.4 - 6.5

EPSS0.00337

SSVC