En bref
- CVE-2022-32213 est une vulnérabilité MOYENNE (CVSS 6.5) touchant llhttp (llhttp), node.js (nodejs), sinec ins (siemens).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 44.8%, plus élevée que 98.8% des vulnérabilités.
- Correctif : mettre à jour vers 6.0.7, 2.1.5, 14.20.1, 16.17.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| llhttp | ≥ 6.0.0, < 6.0.7< 2.1.5
| 6.0.72.1.5
|
| node.js | ≥ 14.0.0, ≤ 14.14.0≥ 14.15.0, < 14.20.1≥ 16.0.0, ≤ 16.12.0≥ 16.13.0, < 16.17.1≥ 18.0.0, < 18.9.1
| 14.20.116.17.118.9.1
|
| sinec ins | = 1.0
| No fix yet |
| stormshield management center | < 3.3.2
| 3.3.2
|
| llhttp npm | < 6.0.7
| 6.0.7
|
Description
The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Impacts:
- All versions of the nodejs 18.x, 16.x, and 14.x releases lines.
- llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js
NVD description
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free