| 제목 | CVE-2021-22959, CVE-2021-22960 in Node.JS |
|---|
| 설명 | HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)
The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
The fix for this is included in llhttp v2.1.4 and v6.0.6.
Thanks to Mattias Grenfeldt (https://grenfeldt.dev/) and Asta Olofsson for reporting this vulnerability.
Impacts:
All versions of the 16.x, 14.x, and 12.x releases lines.
HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)
The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.
THe fix for this is included in llhttp v2.1.4 and v6.0.6.
Thanks to Mattias Grenfeldt (https://grenfeldt.dev/) and Asta Olofsson for reporting this vulnerability.
Impacts:
All versions of the 16.x, 14.x, and 12.x releases lines.
|
|---|
| 원천 | ⚠️ https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/ |
|---|
| 사용자 | CSieberg (UID 13359) |
|---|
| 제출 | 2021. 10. 14. AM 11:42 (5 연령 ago) |
|---|
| 모더레이션 | 2021. 10. 14. AM 11:47 (5 minutes later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 184405 [Node.js 까지 12.22.6/14.18.0/16.11.0 llhttp 권한 상승] |
|---|
| 포인트들 | 20 |
|---|