Oracle Linux: CVE-2023-23936: ELSA-2023-1582: nodejs:16 security, bug fix, and enhancement update (MODERATE) (Multiple Advisories)

Oracle Linux: CVE-2023-23936: ELSA-2023-1582:nodejs:16 security, bug fix, and enhancement update (MODERATE) (Multiple Advisories)

Severity

6

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:N)

Published

02/16/2023

Created

05/05/2023

Added

04/05/2023

Modified

01/08/2025

Description

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici. A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection.

Solution(s)

• oracle-linux-upgrade-nodejs
• oracle-linux-upgrade-nodejs-devel
• oracle-linux-upgrade-nodejs-docs
• oracle-linux-upgrade-nodejs-full-i18n
• oracle-linux-upgrade-nodejs-libs
• oracle-linux-upgrade-nodejs-nodemon
• oracle-linux-upgrade-nodejs-packaging
• oracle-linux-upgrade-nodejs-packaging-bundler
• oracle-linux-upgrade-npm

References

• https://attackerkb.com/topics/cve-2023-23936
• CVE - 2023-23936
• ELSA-2023-1582
• ELSA-2023-2654
• ELSA-2023-2655
• ELSA-2023-1583