PT-2022-6180
CVE-2022-35256
·
تاريخ النشر
2022-09-23
·
تاريخ التحديث
2026-10-21
الوصف من
CVSS 2.0
10
عاليةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Node versions 18.7.0
Description
The issue is related to the llhttp parser in the http module, which does not correctly handle header fields that are not terminated with CLRF, potentially resulting in HTTP Request Smuggling. There is also a mention of a vulnerability in the SINEC INS software related to bypassing the authentication mechanism, allowing a remote attacker to execute arbitrary code.
Recommendations
For Node version 18.7.0, update to a newer version to mitigate the risk of HTTP Request Smuggling.
As a temporary workaround, consider restricting the handling of header fields that are not terminated with CLRF until a patch is available.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾