Release Date: | 2021-01-06 | |
Impact: | None | What is this? |
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.
See more information about CVE-2020-8287 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
Base Score: | 6.5 |
Vector String: | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Version: | 3.0 |
Attack Vector: | Network |
Attack Complexity: | Low |
Privileges Required: | None |
User Interaction: | None |
Scope: | Unchanged |
Confidentiality Impact: | Low |
Integrity Impact: | Low |
Availability Impact: | None |
Platform | Errata | Release Date |
Oracle Linux version 8 (nodejs) | ELSA-2021-0548 | 2021-02-20 |
Oracle Linux version 8 (nodejs) | ELSA-2021-0549 | 2021-02-20 |
Oracle Linux version 8 (nodejs) | ELSA-2021-0551 | 2021-02-20 |
Oracle Linux version 8 (nodejs-nodemon) | ELSA-2021-0548 | 2021-02-20 |
Oracle Linux version 8 (nodejs-nodemon) | ELSA-2021-0549 | 2021-02-20 |
Oracle Linux version 8 (nodejs-nodemon) | ELSA-2021-0551 | 2021-02-20 |
Oracle Linux version 8 (nodejs-packaging) | ELSA-2021-0548 | 2021-02-20 |
Oracle Linux version 8 (nodejs-packaging) | ELSA-2021-0551 | 2021-02-20 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections: