CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

(CVE-2022-25881)

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.(CVE-2022-32212)

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).(CVE-2022-32213)

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32214)

The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).(CVE-2022-32215)

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.(CVE-2022-35256)

A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.(CVE-2023-23918)

An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges.(CVE-2023-23920)

The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition.

References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases(CVE-2023-30581)

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 (CVE-2023-30589)

The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.

References: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases(CVE-2023-30590)

The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.

Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.(CVE-2023-32002)

The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.

This vulnerability affects all users using the experimental…

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

• nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

• nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

• nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

• got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)

• nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

• nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

• nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

• nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

• nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

• got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:16/nodejs: rebase to latest upstream release (BZ#2106369)

• nodejs:16/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111416)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

• nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

• nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

• nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)

• normalize-url: ReDoS for data URLs (CVE-2021-33502)

• nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)

• nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

• nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

• nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

• nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

• got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019)

• nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
• nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
• nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
• nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
• got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:14/nodejs: rebase to latest upstream release (BZ#2106367)
• nodejs:14/nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2111417)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233)

Security Fix(es):

• nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)
• nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)
• nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)
• normalize-url: ReDoS for data URLs (CVE-2021-33502)
• nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244)
• nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)
• nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)
• nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)
• nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)
• got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [almalinux-9] (BZ#2121019)
• nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. (CVE-2021-43616)

DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (CVE-2022-32213)

HTTP Request Smuggling - Improper Delimiting of Header Fields (CVE-2022-32214)

HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (CVE-2022-32215)

Attempt to read openssl.cnf from /home/iojs/build/ upon startup (CVE-2022-32222)

DNS rebinding in --inspect on macOS (CVE-2022-32212) Bypass via obs-fold mechanic (CVE-2022-32213) HTTP Request Smuggling Due to Incorrect Parsing of Header Fields (CVE-2022-35256)

These are all security issues fixed in the corepack16-16.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack18-18.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs16 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).

The following non-security bug was fixed:

• Add buildtime version check to determine if we need patched openssl Requires: or already in upstream. (bsc#1192489)

This update for nodejs14 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).�

This update for nodejs12 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).
• CVE-2022-2097: Fixed missing encrypted bytes in AES OCB mode (bsc#1201099).

This update for nodejs14 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).

This update for nodejs12 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).

This update for nodejs16 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).

This update for nodejs16 fixes the following issues:

• CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
• CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
• CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
• CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).

The following non-security bug was fixed:

• Add buildtime version check to determine if we need patched openssl Requires: or already in upstream. (bsc#1192489)

This update for nodejs10 fixes the following issues:

• CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues during HTTP/2 stream cancellation (bsc#1188917, bsc#1189368).
• CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2021-22960, CVE-2021-22959: Fixed multiple HTTP request smuggling issues in the underlying HTTP parser (bsc#1201325, bsc#1201326, bsc#1201327, bsc#1191602, bsc#1191601).
• CVE-2022-32212: Fixed a DNS rebinding issue caused by improper IPv4 validation (bsc#1201328).

This update for nodejs18 fixes the following issues:

This update ships nodejs18 (jsc#PED-2097)

Update to NodejJS 18.13.0 LTS:

• build: disable v8 snapshot compression by default

• crypto: update root certificates

• deps: update ICU to 72.1

• doc:

  • add doc-only deprecation for headers/trailers setters
  • add Rafael to the tsc
  • deprecate use of invalid ports in url.parse
  • deprecate url.parse()

• lib: drop fetch experimental warning

• net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options

• src:

  • add uvwasi version
  • add initial shadow realm support

• test_runner:

  • add t.after() hook
  • don't use a symbol for runHook()

• tls:

  • add 'ca' property to certificate object

• util:

  • add fast path for utf8 encoding
  • improve textdecoder decode performance
  • add MIME utilities

• Fixes compatibility with ICU 72.1 (bsc#1205236)
• Fix migration to openssl-3 (bsc#1205042)

Update to NodeJS 18.12.1 LTS:

• inspector: DNS rebinding in --inspect via invalid octal IP (bsc#1205119, CVE-2022-43548)

Update to NodeJS 18.12.0 LTS:

• Running in 'watch' mode using node --watch restarts the process when an imported file is changed.
• fs: add FileHandle.prototype.readLines
• http: add writeEarlyHints function to ServerResponse
• http2: make early hints generic
• util: add default value option to parsearg

Update to NodeJS 18.11.0:

• added experimental watch mode -- running in 'watch' mode using node --watch restarts the process when an imported file is changed
• fs: add FileHandle.prototype.readLines
• http: add writeEarlyHints function to ServerResponse
• http2: make early hints generic
• lib: refactor transferable AbortSignal
• src: add detailed embedder process initialization API
• util: add default value option to parsearg

Update to NodeJS 18.10.0:

• deps: upgrade npm to 8.19.2
• http: throw error on content-length mismatch
• stream: add ReadableByteStream.tee()

Update to Nodejs 18.9.1:

• deps: llhttp updated to 6.0.10

  • CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
  • Incorrect Parsing of Multi-line Transfer-Encoding (CVE-2022-32215, bsc#1201327)
  • Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)

• crypto: fix weak randomness in WebCrypto keygen (CVE-2022-35255, bsc#1203831)

Update to Nodejs 18.9.0:

• lib - add diagnostics channel for process and worker
• os - add machine method
• report - expose report public native apis
• src - expose environment RequestInterrupt api
• vm - include vm context in the embedded snapshot

Changes in 18.8.0:

• bootstrap: implement run-time user-land snapshots via --build-snapshot and --snapshot-blob. See
• crypto:
  • allow zero-length IKM in HKDF and in webcrypto PBKDF2
  • allow zero-length secret KeyObject
• deps: upgrade npm to 8.18.0
• http: make idle http parser count configurable
• net: add local family
• src: print source map error source on demand
• tls: pass a valid socket on tlsClientError

Update to Nodejs 18.7.0:

• events: add CustomEvent
• http: add drop request event for http server
• lib: improved diagnostics_channel subscribe/unsubscribe
• util: add tokens to parseArgs

• enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)

Update to Nodejs 18.6.0:

• Experimental ESM Loader Hooks API. For details see, https://nodejs.org/api/esm.html
• dns: export error code constants from dns/promises
• esm: add chaining to loaders
• http: add diagnostics channel for http client
• http: add perf_hooks detail for http request and client
• module: add isBuiltIn method
• net: add drop event for net server
• test_runner: expose describe and it
• v8: add v8.startupSnapshot utils

For details, see https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0

Update to Nodejs 18.5.0:

• http: stricter Transfer-Encoding and header separator parsing (bsc#1201325, bsc#1201326, bsc#1201327, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
• src: fix IPv4 validation in…

This update for nodejs18 fixes the following issues:

This update ships nodejs18 (jsc#PED-2097)

Update to NodejJS 18.13.0 LTS:

• build: disable v8 snapshot compression by default

• crypto: update root certificates

• deps: update ICU to 72.1

• doc:

  • add doc-only deprecation for headers/trailers setters
  • add Rafael to the tsc
  • deprecate use of invalid ports in url.parse
  • deprecate url.parse()

• lib: drop fetch experimental warning

• net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options

• src:

  • add uvwasi version
  • add initial shadow realm support

• test_runner:

  • add t.after() hook
  • don't use a symbol for runHook()

• tls:

  • add 'ca' property to certificate object

• util:

  • add fast path for utf8 encoding
  • improve textdecoder decode performance
  • add MIME utilities

• Fixes compatibility with ICU 72.1 (bsc#1205236)
• Fix migration to openssl-3 (bsc#1205042)

Update to NodeJS 18.12.1 LTS:

• inspector: DNS rebinding in --inspect via invalid octal IP (bsc#1205119, CVE-2022-43548)

Update to NodeJS 18.12.0 LTS:

• Running in 'watch' mode using node --watch restarts the process when an imported file is changed.
• fs: add FileHandle.prototype.readLines
• http: add writeEarlyHints function to ServerResponse
• http2: make early hints generic
• util: add default value option to parsearg

Update to NodeJS 18.11.0:

• added experimental watch mode -- running in 'watch' mode using node --watch restarts the process when an imported file is changed
• fs: add FileHandle.prototype.readLines
• http: add writeEarlyHints function to ServerResponse
• http2: make early hints generic
• lib: refactor transferable AbortSignal
• src: add detailed embedder process initialization API
• util: add default value option to parsearg

Update to NodeJS 18.10.0:

• deps: upgrade npm to 8.19.2
• http: throw error on content-length mismatch
• stream: add ReadableByteStream.tee()

Update to Nodejs 18.9.1:

• deps: llhttp updated to 6.0.10

  • CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)
  • Incorrect Parsing of Multi-line Transfer-Encoding (CVE-2022-32215, bsc#1201327)
  • Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)

• crypto: fix weak randomness in WebCrypto keygen (CVE-2022-35255, bsc#1203831)

Update to Nodejs 18.9.0:

• lib - add diagnostics channel for process and worker
• os - add machine method
• report - expose report public native apis
• src - expose environment RequestInterrupt api
• vm - include vm context in the embedded snapshot

Changes in 18.8.0:

• bootstrap: implement run-time user-land snapshots via --build-snapshot and --snapshot-blob. See
• crypto:
  • allow zero-length IKM in HKDF and in webcrypto PBKDF2
  • allow zero-length secret KeyObject
• deps: upgrade npm to 8.18.0
• http: make idle http parser count configurable
• net: add local family
• src: print source map error source on demand
• tls: pass a valid socket on tlsClientError

Update to Nodejs 18.7.0:

• events: add CustomEvent
• http: add drop request event for http server
• lib: improved diagnostics_channel subscribe/unsubscribe
• util: add tokens to parseArgs

• enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)

Update to Nodejs 18.6.0:

• Experimental ESM Loader Hooks API. For details see, https://nodejs.org/api/esm.html
• dns: export error code constants from dns/promises
• esm: add chaining to loaders
• http: add diagnostics channel for http client
• http: add perf_hooks detail for http request and client
• module: add isBuiltIn method
• net: add drop event for net server
• test_runner: expose describe and it
• v8: add v8.startupSnapshot utils

For details, see https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0

Update to Nodejs 18.5.0:

• http: stricter Transfer-Encoding and header separator parsing (bsc#1201325, bsc#1201326, bsc#1201327, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
• src: fix IPv4 validation in…

Axel Chong discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2022-32212)

Zeyu Zhang discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)

It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-35256)

It was discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-43548)