PT-2023-9604
CVE-2023-23936
·
تاريخ النشر
2023-01-03
·
تاريخ التحديث
2026-09-18
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Undici versions 2.0.0 through 5.19.0
Description
The issue is related to the undici library not protecting the
host HTTP header from CRLF injection vulnerabilities. This could allow a remote attacker to inject arbitrary HTTP headers. The undici library is an HTTP/1.1 client for Node.js. As a workaround, sanitizing the headers.host string before passing it to undici can help mitigate the issue.Recommendations
For versions 2.0.0 through 5.19.0, update to version 5.19.1 to resolve the issue.
As a temporary workaround, consider sanitizing the
headers.host string before passing it to undici.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾