Bug 1208413 (CVE-2023-24807) - VUL-0: CVE-2023-24807: nodejs: node-undici: ReDoS via `Headers.set()` and `Headers.append()` methods
Summary: VUL-0: CVE-2023-24807: nodejs: node-undici: ReDoS via `Headers.set()` and `He...
Status: RESOLVED FIXED
Alias: CVE-2023-24807
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Adam Majer
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/357434/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-24807:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-02-17 08:40 UTC by Gabriele Sonnu
Modified: 2023-05-03 12:54 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gabriele Sonnu 2023-02-17 08:40:34 UTC
CVE-2023-24807

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the
`Headers.set()` and `Headers.append()` methods are vulnerable to Regular
Expression Denial of Service (ReDoS) attacks when untrusted values are passed
into the functions. This is due to the inefficient regular expression used to
normalize the values in the `headerValueNormalize()` utility function. This
vulnerability was patched in v5.19.1. No known workarounds are available.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24807
https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf
https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w
https://www.cve.org/CVERecord?id=CVE-2023-24807
https://github.com/nodejs/undici/releases/tag/v5.19.1
https://hackerone.com/bugs?report_id=1784449
Comment 1 Gabriele Sonnu 2023-02-17 08:51:14 UTC
We embed node-undici in:

- SUSE:SLE-12-SP5:Update/nodejs16     node-undici (5.10.0)
- SUSE:SLE-12-SP5:Update/nodejs18     node-undici (5.13.0)
- SUSE:SLE-15-SP3:Update/nodejs16     node-undici (5.10.0)
- SUSE:SLE-15-SP4:Update/nodejs16     node-undici (5.10.0)
- SUSE:SLE-15-SP4:Update/nodejs18     node-undici (5.13.0)
- openSUSE:Factory/nodejs18           node-undici (5.13.0)
- openSUSE:Factory/nodejs19           node-undici (5.16.0)
Comment 2 OBSbugzilla Bot 2023-02-22 16:35:02 UTC
This is an autogenerated message for OBS integration:
This bug (1208413) was mentioned in
https://build.opensuse.org/request/show/1067186 Factory / nodejs19
https://build.opensuse.org/request/show/1067187 Factory / nodejs18
Comment 5 Maintenance Automation 2023-03-03 12:30:09 UTC
SUSE-SU-2023:0609-1: An update that solves five vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1205568, 1208413, 1208481, 1208483, 1208485, 1208487
CVE References: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807
Sources used:
Web and Scripting Module 12 (src): nodejs16-16.19.1-8.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Maintenance Automation 2023-03-03 12:30:14 UTC
SUSE-SU-2023:0608-1: An update that solves five vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1205568, 1208413, 1208481, 1208483, 1208485, 1208487
CVE References: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807
Sources used:
openSUSE Leap 15.4 (src): nodejs16-16.19.1-150400.3.15.1
Web and Scripting Module 15-SP4 (src): nodejs16-16.19.1-150400.3.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2023-03-08 16:30:15 UTC
SUSE-SU-2023:0673-1: An update that solves five vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1205568, 1208413, 1208481, 1208483, 1208485, 1208487
CVE References: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807
Sources used:
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): nodejs16-16.19.1-150300.7.18.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): nodejs16-16.19.1-150300.7.18.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): nodejs16-16.19.1-150300.7.18.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): nodejs16-16.19.1-150300.7.18.1
SUSE Manager Server 4.2 (src): nodejs16-16.19.1-150300.7.18.1
SUSE Enterprise Storage 7.1 (src): nodejs16-16.19.1-150300.7.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Maintenance Automation 2023-03-13 12:30:02 UTC
SUSE-SU-2023:0715-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208413, 1208481, 1208483, 1208485, 1208487
CVE References: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807
Sources used:
Web and Scripting Module 12 (src): nodejs18-18.14.2-8.6.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Maintenance Automation 2023-03-15 08:30:01 UTC
SUSE-SU-2023:0738-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1208413, 1208481, 1208483, 1208485, 1208487
CVE References: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920, CVE-2023-23936, CVE-2023-24807
Sources used:
openSUSE Leap 15.4 (src): nodejs18-18.14.2-150400.9.6.2
Web and Scripting Module 15-SP4 (src): nodejs18-18.14.2-150400.9.6.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.