Lucene search

[email protected]CVE-2022-35256

HistoryDec 05, 2022 - 10:15 p.m.

CVE-2022-35256

2022-12-0522:15:10

CWE-444

[email protected]

web.nvd.nist.gov

284

cve-2022-35256

http

node

vulnerability

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

7.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.0%

JSON

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

Affected configurations

NVD

Node

nodejsnode.jsRange14.0.0–14.14.0-

nodejsnode.jsRange14.15.0–14.20.1lts

nodejsnode.jsRange16.0.0–16.12.0-

nodejsnode.jsRange16.13.0–16.17.1lts

nodejsnode.jsRange18.0.0–18.9.1-

Node

llhttpllhttpRange<6.0.10node.js

Node

siemenssinec_insRange<1.0

siemenssinec_insMatch1.0-

siemenssinec_insMatch1.0sp1

siemenssinec_insMatch1.0sp2

Node

debiandebian_linuxMatch11.0

CPENameOperatorVersion
nodejs:node.jsnodejs node.jsle14.14.0
nodejs:node.jsnodejs node.jslt14.20.1
nodejs:node.jsnodejs node.jsle16.12.0
nodejs:node.jsnodejs node.jslt16.17.1
nodejs:node.jsnodejs node.jslt18.9.1

CPE	Name	Operator	Version
nodejs:node.js	nodejs node.js	le	14.14.0
nodejs:node.js	nodejs node.js	lt	14.20.1
nodejs:node.js	nodejs node.js	le	16.12.0
nodejs:node.js	nodejs node.js	lt	16.17.1
nodejs:node.js	nodejs node.js	lt	18.9.1

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/nodejs/node",
    "versions": [
      {
        "version": "Fixed in 14.20.1+, 16.17.1+,18.9.1+",
        "status": "affected"
      }
    ]
  }
]