undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to
    _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the
    `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput =
    'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET',
    headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two
    requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This
    issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a
    workaround. (CVE-2022-35948)

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3251-1 advisory.

    - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of     undici.request (bsc#1202382).
    - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
    - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives     when run in a workspace (bsc#1200517).
    - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

    Bugfixes:

    - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3250-1 advisory.

    - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of     undici.request (bsc#1202382).
    - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
    - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives     when run in a workspace (bsc#1200517).
    - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

    Bugfixes:

    - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3196-1 advisory.

    - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of     undici.request (bsc#1202382).
    - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
    - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives     when run in a workspace (bsc#1200517).
    - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).

    Bugfixes:

    - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
414348	SCA: security update for undici (GHSA-f772-66g8-q5h3)	Tenable Cloud Security	SCA Checks	Local	medium
414348	SCA: security update for undici (GHSA-f772-66g8-q5h3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
195166	GLSA-202405-29 : Node.js: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
164977	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2022:3251-1)	Nessus	SuSE Local Security Checks	Local	critical
164969	SUSE SLES15 / openSUSE 15 Security Update : nodejs16 (SUSE-SU-2022:3250-1)	Nessus	SuSE Local Security Checks	Local	critical
164902	SUSE SLES12 Security Update : nodejs16 (SUSE-SU-2022:3196-1)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2022-35948

medium

Tenable Plugins

medium

medium

critical

critical

critical

critical