Veracode Vulnerability DatabaseVERACODE:6261Incorrect HTTP Content Length Parsing
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
node is vulnerable to incorrect HTTP content length parsing. The vulnerability exists as node does not reject spaces in the value of the Content-Length header, allowing large Content-Length to be parsed and potentially bypassing a policy that restricts the value of Content-Length.
References
access.redhat.com/errata/RHSA-2019:2258
bugzilla.redhat.com/show_bug.cgi?id=1562026
github.com/nodejs/node/commit/80310e916aff24dc6b3477ad52a697dff84fc78e
github.com/nodejs/node/commit/b2a6c9745298c11f05bd8583761439ee701721c9
github.com/nodejs/node/commit/ebe51d6492c3993020e1859b5269aa783fad0a4a
github.com/nodejs/node/commit/ffbcd1d1d154a793cf4f2db7fbca66f80ef374b5
nodejs.org/en/blog/vulnerability/march-2018-security-releases/
support.f5.com/csp/article/K27228191?utm_source=f5support&utm_medium=RSS
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N