Lucene search

OpenJS FoundationFRIENDSOFPHP:NYHOLM:PSR7:2023-04-17

HistoryApr 17, 2023 - 4:00 p.m.

Improper Input Validation in headers

2023-04-1716:00:00

OpenJS Foundation

github.com

improper input validation

header parsing

newline character

patched issue

vulnerability

cve-2023-29197

rfc 7230

security advisory

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.5%

JSON

Description Impact Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. Patches The issue is patched in 1.6.1. Workarounds There are no known workarounds. References https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 References GHSA-wjfc-pgfp-pv9c GHSA-q7rv-6hp3-vh96 GHSA-wxmh-65f7-jcvw https://nvd.nist.gov/vuln/detail/CVE-2023-29197 https://github.com/FriendsOfPHP/security-advisories/blob/master/nyholm/psr7/2023-04-17.yaml

Affected configurations

Vulners

Node

nyholmpsr7Range<1.6.1

CPENameOperatorVersion
nyholm/psr7lt1.6.1

CPE	Name	Operator	Version
	nyholm/psr7	lt	1.6.1

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.5%

JSON

Related for FRIENDSOFPHP:NYHOLM:PSR7:2023-04-17