CVE-2021-22959

概要

参考情報

• hackerone.com/reports/1238709 · Exploit
• debian.org/security/2022/dsa-5170 · Mailing List
• oracle.com/security-alerts/cpujan2022.html · Patch

llhttp のその他の脆弱性

• CVE-2022-35256中 6.5The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may res…
• CVE-2022-32215中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea…
• CVE-2022-32214中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re…
• CVE-2022-32213中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding he…
• CVE-2021-22960中 6.5The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Req…