UBUNTU-CVE-2022-35256

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2022-35256
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-35256.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-35256
Related
Published
2022-12-05T22:15:00Z
Modified
2025-06-02T17:16:29Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

References

Affected packages

Ubuntu:22.04:LTS / nodejs

Package

Name
nodejs
Purl
pkg:deb/ubuntu/nodejs@12.22.9~dfsg-1ubuntu3.2?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.22.9~dfsg-1ubuntu3.2

Affected versions

12.*

12.22.5~dfsg-5ubuntu1
12.22.7~dfsg-2ubuntu1
12.22.7~dfsg-2ubuntu3
12.22.9~dfsg-1ubuntu2
12.22.9~dfsg-1ubuntu3
12.22.9~dfsg-1ubuntu3.1

Ecosystem specific 

{
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_name": "libnode-dev",
            "binary_version": "12.22.9~dfsg-1ubuntu3.2"
        },
        {
            "binary_name": "libnode72",
            "binary_version": "12.22.9~dfsg-1ubuntu3.2"
        },
        {
            "binary_name": "libnode72-dbgsym",
            "binary_version": "12.22.9~dfsg-1ubuntu3.2"
        },
        {
            "binary_name": "nodejs",
            "binary_version": "12.22.9~dfsg-1ubuntu3.2"
        },
        {
            "binary_name": "nodejs-dbgsym",
            "binary_version": "12.22.9~dfsg-1ubuntu3.2"
        },
        {
            "binary_name": "nodejs-doc",
            "binary_version": "12.22.9~dfsg-1ubuntu3.2"
        }
    ],
    "availability": "No subscription required"
}