跳转到帖子

Red Hat: CVE-2024-22025: nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (Multiple Advisories)

recommended_posts

发布于
  • Members

Red Hat: CVE-2024-22025: nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (Multiple Advisories)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
03/19/2024
Created
05/10/2024
Added
05/13/2024
Modified
09/06/2024

Description

A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch() function in Node.js always decodes Brotli, making it possible for an attacker to cause resource exhaustion when fetching content from an untrusted URL. An attacker controlling the URL passed into fetch() can exploit this vulnerability to exhaust memory, potentially leading to process termination, depending on the system configuration.

Solution(s)

  • redhat-upgrade-nodejs
  • redhat-upgrade-nodejs-debuginfo
  • redhat-upgrade-nodejs-debugsource
  • redhat-upgrade-nodejs-devel
  • redhat-upgrade-nodejs-docs
  • redhat-upgrade-nodejs-full-i18n
  • redhat-upgrade-nodejs-libs
  • redhat-upgrade-nodejs-libs-debuginfo
  • redhat-upgrade-nodejs-nodemon
  • redhat-upgrade-nodejs-packaging
  • redhat-upgrade-nodejs-packaging-bundler
  • redhat-upgrade-npm

References

  • CVE-2024-22025
  • RHSA-2024:2778
  • RHSA-2024:2779
  • RHSA-2024:2780
  • RHSA-2024:2853
  • RHSA-2024:2910
  • RHSA-2024:4559
View more
  • 查看数 704
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。
注意:你的帖子需要版主批准后才能看到。

游客
回帖…