Bug#1036978: bookworm-pu: package node-undici/5.15.0+dfsg1+~cs20.10.9.3-1+deb12u1
Control: tag -1 confirmed
On Wed, May 31, 2023 at 04:00:47PM +0400, Yadd wrote:
> [ Reason ]
> node-undici is vulnerable to:
> * CVE-2023-23936: "Host" HTTP header isn't protected against CLRF injection
> * CVE-2023-24807: Regex Denial of Service on headers set/append
Please update the changelog to mention the CVE identifiers; other than
that, go ahead.
Thanks,
--
Jonathan Wiltshire jmw@debian.org
Debian Developer http://people.debian.org/~jmw
4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1
Reply to: