Most recent entries from all

bdu:2024-02800

BELL-CVE-2024-24758

Affected: Alpaquita:23: nodejs, Alpaquita:stream: nodejs, BellSoft Hardened Containers:23: nodejs, BellSoft Hardened Containers:stream: nodejs

certfr-2024-avi-0366 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0366

EUVD-2026-217238

fkie_cve-2024-24758

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-3787-6prv-h9w3 — Undici proxy-authorization header not cleared on cross-origin redirect in fetch

Affected: npm: undici

### Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authorization` headers.

### Patches

This is patched in v5.28.3 and v6.6.1

### Workarounds

There are no known workarounds.

### References

- https://fetch.spec.whatwg.org/#authentication-entries - https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g

gsd-2024-24758

ICSA-24-319-08 — Siemens SINEC INS

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue. The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control cha…

msrc_CVE-2024-24758 — Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

msrc_CVE-2024-24758

openSUSE-SU-2024:13697-1 — corepack20-20.11.1-1.1 on GA media

corepack20-20.11.1-1.1 on GA media

SUSE-SU-2024:0643-1 — Security update for nodejs20

Security update for nodejs20

UBUNTU-CVE-2024-24758

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici

WID-SEC-W-2024-0393 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder seine Privilegien zu erweitern.