REDHAT-BUG-2447141: Medium severity npm/undici vulnerability
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:
Inject arbitrary HTTP headers Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch) The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:
// lib/dispatcher/client-h1.js:1121 if (upgrade) { header += connection: upgrade\r\nupgrade: ${upgrade}\r\n }
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2447141?
The severity of REDHAT-BUG-2447141 is classified as medium with a risk score of 4.
What impact does REDHAT-BUG-2447141 have on applications?
REDHAT-BUG-2447141 allows attackers to inject CRLF sequences, which can lead to the injection of arbitrary HTTP headers and the premature termination of HTTP requests.
How can I fix REDHAT-BUG-2447141?
To fix REDHAT-BUG-2447141, ensure proper validation and sanitization of user-controlled input before using it in the upgrade option of client.request().
Which software is affected by REDHAT-BUG-2447141?
The vulnerability REDHAT-BUG-2447141 affects the npm/undici software.
What kind of attacks can REDHAT-BUG-2447141 facilitate?
REDHAT-BUG-2447141 can facilitate attacks such as HTTP header injection and HTTP request smuggling to non-HTTP services like Redis and Elasticsearch.