CVE-2021-22960

概要

参考情報

• hackerone.com/reports/1238099 · Exploit
• debian.org/security/2022/dsa-5170 · Third Party Advisory
• oracle.com/security-alerts/cpujan2022.html · Patch

llhttp のその他の脆弱性

• CVE-2022-35256中 6.5The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may res…
• CVE-2022-32215中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea…
• CVE-2022-32214中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re…
• CVE-2022-32213中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding he…
• CVE-2021-22959中 6.5The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS)…