-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3246-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Chris Lamb December 23, 2022 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : node-hawk Version : 6.0.1+dfsg-1+deb10u1 CVE IDs : CVE-2022-29167 It was discovered that there was an issue in Hawk, an HTTP authentication scheme. Hawk used a regular expression to parse `Host` HTTP headers which was subject to regular expression DoS attack. Each added character in the attacker's input increased the computation time exponentially. For Debian 10 buster, this problem has been fixed in version 6.0.1+dfsg-1+deb10u1. We recommend that you upgrade your node-hawk packages. For the detailed security status of node-hawk please refer to its security tracker page at: https://security-tracker.debian.org/tracker/node-hawk Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmOlSUoACgkQHpU+J9Qx HlhNdg//Uh/J87xJoT7+oUBVlpX5Ll33QWdB+zsvBg7ddOa4P/DZV/Cpuhdz8I9z PUkLyJn1r8M0NIDL8hyYvzgrNRden2tuGrFFHi+xGnfFwlKGVGtGlZRZ8XDioGrL pb1KV83dPfVIQaO8uQVSuImh7XCqu/5R/eT6RfzQ90ulW4s1JIy4wMJmD+aH1O43 rRW/2OLYkYXVOMll9uAXZaWNLbse3pw7eRppJp7XPct94d3maTidODD2XCVsEd8t RIz8cK9yMV13INKs8Apt7SWdWWgdf3Aj8F5idAmWB4tKoBYjYU6+R8/r4wISVU+J aBcviqGKxtTUWxvBp0oP5403y+6aHTDu5Y+slrVN2JmGsCqRljVVabzYyZSnxFq1 IIp+j88RbsBq64IIIFlxiUPMLYE4r85ysGmjREndmPsFiFxZkXHLLFVq9Gw/Iij6 BpdaC4ED6Fz0HgGltTQRVQMTxPrr6McFZmGuh7equwtxorpHmLca1jVmHXqif9R3 dWpNkQ9FaNuq2PNUiScyXp8oOcwGBp27nzv6EhVf4GeXQ0Oins/8hn02z3bBRdwB yQLsa3ylGPfaGzGAYNZZ9zYbNexaFaBzt/GvVWxijC8Ab3zrGlsIRTdIWSue2KK0 p0oRpOU9uE+9nDNdp22gzVOO2dp57yqUcnwAz1CzB9Mkm53pj1Q= =M6eO -----END PGP SIGNATURE-----