CVE-2024-24758

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

• https://fetch.spec.whatwg.org/#authentication-entries
• https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

TuxCare rebuilt undici to address 14 CVEs. Fixed in 5.5.1-tuxcare.1.

These are all security issues fixed in the corepack20-20.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack21-21.6.2-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2024-24758 in the node-undici package for Root:Debian:12. Multiple fixed versions available.

This update for nodejs20 fixes the following issues:

Update to 20.11.1: (security updates)

• CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).
• CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
• CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j
• CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).
• CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
• CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).
• CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).
• CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
• CVE-2024-24758: undici version 5.28.3 (bsc#1220017).
• CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).

Update to 20.11.0:

• esm: add import.meta.dirname and import.meta.filename
• fs: add c++ fast path for writeFileSync utf8
• module: remove useCustomLoadersIfPresent flag
• module: bootstrap module loaders in shadow realm
• src: add --disable-warning option
• src: create per isolate proxy env template
• src: make process binding data weak
• stream: use Array for Readable buffer
• stream: optimize creation
• test_runner: adds built in lcov reporter
• test_runner: add Date to the supported mock APIs
• test_runner, cli: add --test-timeout flag

Update to 20.10.0:

• --experimental-default-type flag to flip module defaults
• The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.
• Added flush option in file system functions for fs.writeFile functions
• Added experimental WebSocket client
• vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script

This update for nodejs18 fixes the following issues:

Update to 18.19.1: (security updates)

• CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).
• CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
• CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
• CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
• CVE-2024-24758: undici version 5.28.3 (bsc#1220017).
• CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).

Update to LTS version 18.19.0

• deps: npm updates to 10.x
• esm:
  • Leverage loaders when resolving subsequent loaders
  • import.meta.resolve unflagged
  • --experimental-default-type flag to flip module defaults

This update for nodejs16 fixes the following issues:

Security issues fixed:

• CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
• CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
• CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
• CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).
• CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs16 fixes the following issues:

Security issues fixed:

• CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
• CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
• CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
• CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).
• CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs18 fixes the following issues:

Update to 18.19.1: (security updates)

• CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).
• CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
• CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
• CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
• CVE-2024-24758: undici version 5.28.3 (bsc#1220017).
• CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).

Update to LTS version 18.19.0

• deps: npm updates to 10.x
• esm:
  • Leverage loaders when resolving subsequent loaders
  • import.meta.resolve unflagged
  • --experimental-default-type flag to flip module defaults

This update for nodejs16 fixes the following issues:

Security issues fixed:

• CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).
• CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).
• CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).
• CVE-2024-24758: ignore proxy-authorization header (bsc#1220017).
• CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).