Debian Security Bug TrackerDEBIANCVE:CVE-2023-23936CVE-2023-23936
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
Percentile
50.9%
Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to undici.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | node-undici | < 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1 | node-undici_5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1_all.deb |
| Debian | 999 | all | node-undici | < 5.19.1+dfsg1+~cs20.10.9.5-1 | node-undici_5.19.1+dfsg1+~cs20.10.9.5-1_all.deb |
| Debian | 13 | all | node-undici | < 5.19.1+dfsg1+~cs20.10.9.5-1 | node-undici_5.19.1+dfsg1+~cs20.10.9.5-1_all.deb |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
Percentile
50.9%