CVE-2022-35256

概要

参考情報

• cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf · Third Party Advisory
• hackerone.com/reports/1675191 · Exploit
• debian.org/security/2023/dsa-5326 · Third Party Advisory

llhttp のその他の脆弱性

• CVE-2022-32215中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding hea…
• CVE-2022-32214中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP re…
• CVE-2022-32213中 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding he…
• CVE-2021-22959中 6.5The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS)…
• CVE-2021-22960中 6.5The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Req…