SUSE CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

...

AZL-35235 CVE-2022-35256 affecting package rust for versions less than 1.75.0-1

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

DEBIAN-CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

AZL-31039 CVE-2022-35256 affecting package rust for versions less than 1.68.0-1

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

UBUNTU-CVE-2022-35256

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling...

Security fix for the ALT Linux 10 package node version 16.17.1-alt1

Sept. 30, 2022 Vitaly Lipatov 16.17.1-alt1 - new version 16.17.1 with rpmrb script - set npm = 8.15.0 - CVE-2022-32212: DNS rebinding in --inspect on macOS High - CVE-2022-32213: bypass via obs-fold mechanic Medium - CVE-2022-35255: Weak randomness in WebCrypto keygen - CVE-2022-35256: HTTP Reque...

PT-2022-6180

Name of the Vulnerable Software and Affected Versions Node versions 18.7.0 Description The issue is related to the llhttp parser in the http module, which does not correctly handle header fields that are not terminated with CLRF, potentially resulting in HTTP Request Smuggling. There is also a...

PT-2022-22662

Name of the Vulnerable Software and Affected Versions Node.js version 18 Description A weak randomness issue exists in the WebCrypto keygen due to a change with EntropySource in SecretKeyGenTraits::DoKeyGen in src/crypto/crypto keygen.cc. There are two main problems: 1. The return value of...

GHSA-WFF4-FPWG-QQV3 Unexpected server crash in Next.js

Impact When specific requests are made to the Next.js server it can cause an unhandledRejection in the server which can crash the process to exit in specific Node.js versions with strict unhandledRejection handling. - Affected: All of the following must be true to be affected by this CVE - Node.j...

Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises (CVE-2022-0778, CVE-2021-38868, CVE-2021-29799, CVE-2021-29790, CVE-2021-29788)

Summary IBM Engineering Requirements Quality Assistant On-Premises affected by multiple vulnerabilites including OpenSSL, cross-site scripting, cross-site request forgery CVE-2022-0778, CVE-2021-38868, CVE-2021-29799, CVE-2021-29790, CVE-2021-29788 which allowed an attacker or an unauthenticated...

PT-2022-21160 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js versions 18.x prior to 18.40.0 Description: A cryptographic issue exists in Node.js on Linux, where the default path for openssl.cnf might be accessible to a non-admin user under certain circumstances, instead of being located in...

Security fix for the ALT Linux 10 package node version 16.14.2-alt1

April 23, 2022 Vitaly Lipatov 16.14.2-alt1 - new version 16.14.2 with rpmrb script - set openssl = 1.1.1n - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates High...

Security fix for the ALT Linux 10 package node version 16.13.2-alt1

March 18, 2022 Vitaly Lipatov 16.13.2-alt1 - new version 16.13.2 with rpmrb script - set npm = 8.3.1 - set libuv = 1.43.0 - CVE-2021-44531: Improper handling of URI Subject Alternative Names Medium - CVE-2021-44532: Certificate Verification Bypass via String Injection Medium - CVE-2021-44533:...

Security fix for the ALT Linux 10 package node version 14.17.5-alt1

14.17.5-alt1 built Aug. 17, 2021 Vitaly Lipatov in task 282492 Aug. 11, 2021 Vitaly Lipatov - new version 14.17.5 with rpmrb script - set c-ares = 1.17.2 - CVE-2021-3672, CVE-2021-22931: Improper handling of untypical characters in domain names - CVE-2021-22930: Use after free on close http2 on...

Security fix for the ALT Linux 9 package node version 14.17.2-alt1

14.17.2-alt1 built Aug. 3, 2021 Vitaly Lipatov in task 279921 July 1, 2021 Vitaly Lipatov - new version 14.17.2 with rpmrb script - CVE-2021-22918: Out of bounds read set libuv = 1.41.0-alt3...

Prototype Pollution in silentmatt/expr-eval

✍️ Description With speficific input attckers can define properties on prototype, which will lead to prototype pollution. Need node version=12.0.0, which introduce Object.fromEntries 🕵️‍♂️ Proof of Concept // PoC.js const Parser = require'expr-eval'; const o = ; console.log"o.a=", o.a; // o.a=...

Security fix for the ALT Linux 9 package node version 14.15.4-alt1

Feb. 5, 2021 Vitaly Lipatov 14.15.4-alt1 - new version 14.15.4 with rpmrb script - CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference High - CVE-2020-8265: use-after-free in TLSWrap High - CVE-2020-8287: HTTP Request Smuggling in nodejs Low...

Security fix for the ALT Linux 10 package node version 14.15.4-alt1

Feb. 5, 2021 Vitaly Lipatov 14.15.4-alt1 - new version 14.15.4 with rpmrb script - CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference High - CVE-2020-8265: use-after-free in TLSWrap High - CVE-2020-8287: HTTP Request Smuggling in nodejs Low...

Security fix for the ALT Linux 9 package node version 14.15.1-alt1

14.15.1-alt1 built Nov. 26, 2020 Vitaly Lipatov in task 261957 Nov. 16, 2020 Vitaly Lipatov - new version 14.15.1 with rpmrb script - set c-ares = 1.16.1-alt2 - CVE-2020-8277: Denial of Service through DNS request High...