| Summary: | nodejs-hawk new security issue CVE-2022-29167 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, herman.viaene, nicolas.salguero, sysadmin-bugs |
| Version: | 9 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA9-64-OK | ||
| Source RPM: | nodejs-hawk-7.0.10-4.mga9.src.rpm | CVE: | CVE-2022-29167 |
| Status comment: | |||
|
Description
David Walser
2022-12-23 17:47:18 CET
David Walser
2022-12-23 17:47:28 CET
Status comment:
(none) =>
Fixed upstream in 9.0.1 This is clearly for you, Stig (registered pkger, and did last version). Just a version upgrade. Assignee:
bugsquad =>
smelror Ubuntu has issued an advisory for this on May 30: https://ubuntu.com/security/notices/USN-6116-1 Suggested advisory: ======================== The updated package fixes a security vulnerability: Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`. (CVE-2022-29167) References: https://www.debian.org/lts/security/2022/dla-3246 https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq https://ubuntu.com/security/notices/USN-6116-1 ======================== Updated package in core/updates_testing: ======================== nodejs-hawk-7.0.10-4.1.mga9 from SRPM: nodejs-hawk-7.0.10-4.1.mga9.src.rpm Status:
NEW =>
ASSIGNED MGA9-64 Plasma Wayland on HP-Pavillion No instlaation issues. Developer's territory, OK on clean install CC:
(none) =>
herman.viaene As I'm sure Herman found, there are no previous Mageia updates, and urpmq reports it's only required by itself. Validating. CC:
(none) =>
andrewsfarm, sysadmin-bugs
katnatek
2024-03-23 19:24:33 CET
Keywords:
(none) =>
advisory I create it 4 days ago but forget to put the keyword :P An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2024-0086.html Status:
ASSIGNED =>
RESOLVED |