Vulnerability CVE-2022-32215: Information

Description

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-32215
Published: July 14, 2022
Modified: Nov. 7, 2023
Error type identifier: CWE-444

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
nodesisyphus16.16.0-alt120.13.1-alt1ALT-PU-2022-2226-1303524Fixed
nodep1014.21.1-alt116.19.1-alt1ALT-PU-2022-3235-1310516Fixed
nodec10f114.21.1-alt116.19.1-alt1ALT-PU-2022-3235-1310516Fixed
nodec9f216.17.1-alt0.c9.116.19.1-alt0.c9.1ALT-PU-2022-3073-1303505Fixed
nodep1116.16.0-alt120.13.1-alt1ALT-PU-2022-2226-1303524Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/
  • Patch
  • Vendor Advisory
https://hackerone.com/reports/1501679
  • Exploit
  • Issue Tracking
  • Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
  • Patch
  • Third Party Advisory
DSA-5326
  • Third Party Advisory
FEDORA-2022-52dec6351a
    FEDORA-2022-1667f7b60a
      FEDORA-2022-de515f765f

          1. Configuration 1

            cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
            Start including
            18.0.0
            End excliding
            18.5.0
            cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
            Start including
            14.15.0
            End excliding
            14.20.0
            cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
            Start including
            16.13.0
            End excliding
            16.16.0
            cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
            Start including
            14.0.0
            End including
            14.14.0
            cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
            Start including
            16.0.0
            End including
            16.12.0
            cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*
            Start including
            14.0.0
            End excliding
            14.20.1
            cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:*
            Start including
            16.0.0
            End excliding
            16.17.1
            cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:*:*:*
            Start including
            18.0.0
            End excliding
            18.9.1

            Configuration 2

            cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
            cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
            cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

            Configuration 3

            cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
            cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
            cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*

            Configuration 4

            cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

            Configuration 5

            cpe:2.3:a:stormshield:stormshield_management_center:*:*:*:*:*:*:*:*
            End excliding
            3.3.2
        VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
        Version: v24.5.3
        Back to top