Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Feb 7, 2020 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-current | Aug 22, 2024 | Feb 7, 2020 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade npm | Feb 26, 2020 | Feb 7, 2020 |
| Debian | — | Upgrade nodejs | May 1, 2020 | Feb 7, 2020 |
| Freebsd | — | Upgrade nodeUpgrade node10Upgrade node12 | Mar 10, 2020 | Mar 9, 2020 |
| Gentoo Linux | — | Upgrade net-libs/nodejs. | Mar 23, 2020 | Feb 7, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Feb 7, 2020 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade npmUpgrade nodejs-docs | Mar 2, 2020 | Feb 7, 2020 |
| Redhat_linux | — | Upgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-devel-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-devel | Feb 26, 2020 | Feb 7, 2020 |
| Rocky_linux | — | — | Aug 15, 2024 | Feb 7, 2020 |
| Suse | — | Upgrade nodejs10-docsUpgrade nodejs12Upgrade nodejs12-develUpgrade npm6Upgrade nodejs10-develUpgrade nodejs6Upgrade npm10Upgrade nodejs8-docsUpgrade nodejs8Upgrade nodejs6-docsUpgrade nodejs6-develUpgrade npm8Upgrade nodejs8-develUpgrade npm12Upgrade nodejs10Upgrade nodejs12-docs | Mar 2, 2020 | Feb 7, 2020 |
| Ubuntu | — | Upgrade libnode-devUpgrade libnode64Upgrade nodejs-legacy (Ubuntu Pro)Upgrade nodejsUpgrade nodejs-dev (Ubuntu Pro)Upgrade nodejs (Ubuntu Pro) | Sep 20, 2023 | Feb 7, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 7, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub