CVE-2022-32210

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-32210
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-32210.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-32210
Aliases
Published
2022-07-14T15:15:08Z
Modified
2024-06-06T14:01:54.679506Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
[none]
Details

Undici.ProxyAgent never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

References

Affected packages

Git / github.com/nodejs/undici

Affected ranges

Type
GIT
Repo
https://github.com/nodejs/undici
Events

Affected versions

v4.*

v4.10.0
v4.10.1
v4.10.2
v4.10.3
v4.10.4
v4.11.0
v4.11.1
v4.11.2
v4.11.3
v4.12.0
v4.12.2
v4.13.0
v4.14.0
v4.14.1
v4.15.0
v4.15.1
v4.16.0
v4.8.2
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v4.9.4
v4.9.5

v5.*

v5.0.0
v5.1.0
v5.1.1
v5.2.0
v5.3.0
v5.4.0
v5.5.0