Rafael Gonzaga
(Update 07-July-2022) Security releases available
Updates are now available for the v18.x, v16.x, and v14.x Node.js release lines for the following issues.
HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)(CVE-2022-32213)
The llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers.
This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32213 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
- All versions of the 18.x, 16.x, and 14.x releases lines.
llhttpv6.0.7 andllhttpv2.1.5 contains the fixes that were updated inside Node.js
The llhttp parser in the http module does not strictly use the CRLF sequence to delimit HTTP requests.
This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32214 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
- All versions of the 18.x, 16.x, and 14.x releases lines.
llhttpv6.0.7 andllhttpv2.1.5 contains the fixes that were updated inside Node.js
HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)(CVE-2022-32215)
The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers.
This can lead to HTTP Request Smuggling (HRS).
More details will be available at CVE-2022-32215 after publication.
Thank you to Zeyu Zhang (@zeyu2001) for reporting this vulnerability.
Impacts:
- All versions of the 18.x, 16.x, and 14.x releases lines.
llhttpv6.0.7 andllhttpv2.1.5 contains the fixes that were updated inside Node.js
DNS rebinding in --inspect via invalid IP addresses (High)(CVE-2022-32212)
The IsAllowedHost check can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not.
When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), browsers (such as Firefox) will make DNS requests to the DNS server,
providing a vector for an attacker-controlled DNS server or a MITM who can spoof DNS responses to perform a rebinding attack and hence connect to the WebSocket debugger, allowing for arbitrary code execution. This is a bypass of CVE-2021-22884.
More details will be available at CVE-2022-32212 after publication.
Thank you to Axel Chong for reporting this vulnerability.
Impacts:
- All versions of the 18.x, 16.x, and 14.x releases lines.
DLL Hijacking on Windows (High)(CVE-2022-32223)
This vulnerability can be exploited if the victim has the following dependencies on Windows machine:
- OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.
Whenever the above conditions are present, node.exe will search for providers.dll in the current user directory.
After that, node.exe will try to search for providers.dll by the DLL Search Order in Windows.
It is possible for an attacker to place the malicious file providers.dll under a variety of paths and exploit this vulnerability.
More details will be available at CVE-2022-32223 after publication.
Thank you to Yakir Kadkoda from Aqua Security for reporting this vulnerability.
Impacts:
- All versions of the 16.x, and 14.x releases lines.
Note:
- This is a breaking change that has been made to the v14.x, v16.x, and v18.x releases lines.
Node.js can use an OpenSSL configuration file by specifying the environment
variable OPENSSL_CONF, or using the command line option --openssl-conf, and
if none of those are specified will default to reading the default OpenSSL
configuration file openssl.cnf. Node.js will only read a section that is by
default named nodejs_conf.
If your installation was using the default openssl.cnf file and is affected by this breaking change
you can fall back to the previous behavior by:
- Adding
--openssl-shared-configto the command line (Node.js 18.5.0 only); or - Creating a new
nodejs_confsection in that file and copying the contents of the default section into the newnodejs_confsection.
Attempt to read openssl.cnf from /home/iojs/build/ upon startup (Medium)(CVE-2022-32222)
When Node.js starts on linux based systems, it attempts to read /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf,
which ordinarily doesn't exist. On some shared systems an attacker may be able create this file and therefore affect the default OpenSSL configuration for other users.
Thank you to Michael Scovetta from the OpenSSF Alpha-Omega project for reporting this vulnerability.
Impacts:
- Node.js 18.x
OpenSSL - AES OCB fails to encrypt some bytes (Medium)(CVE-2022-2097)
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.
Impacts:
- All versions of the 18.x, 16.x, and 14.x releases lines.
Downloads and release details
(Update 07-Jul-2022) Security Release target July 7th
The Node.js Security Releases will be available on, or shortly after, Thursday, July 7th, 2022.
(Update 05-Jul-2022) OpenSSL Security Release Assessement
With respect to the vulnerabilities in the OpenSSL Security releases of Jul 5th 2022 affects Node.js v18.x, v16.x, and v14.x.
- Node.js is affected by one MODERATE vulnerability on Windows 32-Bit x86.
The security release will be delayed so that we can incorporate the updated OpenSSL versions. We will post another update once we have an updated target for the release date.
Analysis
Our assessment of the security advisory is:
Heap memory corruption with RSA private key operation (CVE-2022-2274) (HIGH)
This vulnerability affects OpenSSL 3.0.4 users. However, Node.js has not shipped any version that used OpenSSL 3.0.4. Therefore, Node.js is not affected.
AES OCB fails to encrypt some bytes (CVE-2022-2097) (MODERATE)
This vulnerability affects Windows 32-Bit x86 users using AES OCB encryption. The serverity is MODERATE.
(Update 04-Jul-2022) OpenSSL Security Release
The OpenSSL versions 1.1.1q and 3.0.5 will be released July, 5th 2022. The announcement can be found here: https://mta.openssl.org/pipermail/openssl-announce/2022-July/000229.html
The Node.js team will evaluate the OpenSSL changes when they are available and then announce the new target date by Thursday or earlier.
Summary
The Node.js project will release new versions of the 14.x, 16.x, and 18.x releases lines on or shortly after Tuesday, July 5th, 2022 in order to address:
- Three medium severity issues.
- Two high severity issues.
Impact
The 18.x release line of Node.js is vulnerable to three medium severity issues and one high severity issues.
The 16.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.
The 14.x release line of Node.js is vulnerable to three medium severity issues and two high severity issues.
Release timing
Releases will be available on, or shortly after, Tuesday, July 5th, 2022.
However, when details of the OpenSSL defects are released on the 5th, our team will be making a more detailed assessment on the likely severity for Node.js users.
The OpenSSL release may delay the Node.js release date. See OpenSSL Security Release
Please monitor the nodejs-sec Google Group for updates, including a decision within 24 hours after the OpenSSL release regarding release timing, and full details of the defects upon eventual release: https://groups.google.com/forum/#!forum/nodejs-sec
The current Node.js security policy can be found at /security/. Please follow the process outlined in https://github.com/nodejs/node/security/policy if you wish to report a vulnerability in Node.js.
Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization.