CRLF injection in undici - CVE-2022-35948

Vulnerability identifier: #VU67164

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-35948

CWE-ID: CWE-93

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of unsanitized input passed as request headers. A remote attacker can pass specially crafted data to the application containing CR-LF characters and modify application behavior.

undici
Gentoo Linux
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Red Hat Advanced Cluster Management for Kubernetes
App Connect Enterprise Certified Container
nodejs16-debuginfo
nodejs16-docs
nodejs16
nodejs16-debugsource
nodejs16-devel
npm16
corepack16

Install updates from vendor's website.

undici - update to 5.8.2
Red Hat Advanced Cluster Management for Kubernetes - update to 2.4.8
App Connect Enterprise Certified Container - addressed in versions 1.1.8, 4.1.0
nodejs16-debuginfo - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16-docs - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16 - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16-debugsource - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
nodejs16-devel - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
npm16 - addressed in versions 16.17.0-8.9.1, 16.17.0-150300.7.9.1, 16.17.0-150400.3.6.1
corepack16 - update to 16.17.0-150400.3.6.1

• https://github.com/nodejs/undici/security/advisories/GHSA-f772-66g8-q5h3
• https://github.com/nodejs/undici/releases/tag/v5.8.2
• https://github.com/nodejs/undici/commit/66165d604fd0aee70a93ed5c44ad4cc2df395f80

• Multiple vulnerabilities in Undici
• SUSE update for nodejs16
• SUSE update for nodejs16
• SUSE update for nodejs16
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Gentoo update for Node.js