CRLF injection in undici - CVE-2022-35948

Vulnerability identifier: #VU67164

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-35948

CWE-ID: CWE-93

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of unsanitized input passed as request headers. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

undici
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Red Hat Advanced Cluster Management for Kubernetes
IBM Maximo Application Suite
App Connect Enterprise Certified Container
Netezza Appliance - Cyclops
Informix Dynamic Server
nodejs16-debuginfo
nodejs16
nodejs16-debugsource
nodejs16-devel
npm16
nodejs16-docs
corepack16

Install updates from vendor's website.

undici - update to 5.8.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.4.8
IBM Maximo Application Suite - addressed in versions 9.0.29, 9.1.21, 9.2.2
App Connect Enterprise Certified Container - addressed in versions 1.1.8, 4.1.0
Netezza Appliance - Cyclops - update to 11.3.1.4
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16
nodejs16-debuginfo - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16 - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16-debugsource - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16-devel - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
npm16 - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16-docs - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
corepack16 - update to 16.17.0-150400.3.6.1

• https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3
• https://github.com/nodejs/undici/releases/tag/v5.8.2
• https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80

• Multiple vulnerabilities in Undici
• SUSE update for nodejs16
• SUSE update for nodejs16
• SUSE update for nodejs16
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Gentoo update for Node.js
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Netezza Appliance - Cyclops
• Multiple vulnerabilities in IBM Informix Dynamic Server