Headline
Ubuntu Security Notice USN-6116-1
Ubuntu Security Notice 6116-1 - It was discovered that hawk incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
==========================================================================
Ubuntu Security Notice USN-6116-1
May 30, 2023
node-hawk vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
hawk could be made to crash if it opened a specially crafted file.
Software Description:
- node-hawk: HTTP Holder-Of-Key Authentication Scheme
Details:
It was discovered that hawk incorrectly handled certain inputs. If a user or
an automated system were tricked into opening a specially crafted input file,
a remote attacker could possibly use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
node-hawk 8.0.1+dfsg-1ubuntu0.22.10.1
Ubuntu 22.04 LTS:
node-hawk 8.0.1+dfsg-1ubuntu0.22.04.1
Ubuntu 20.04 LTS:
node-hawk 7.1.2+dfsg-1ubuntu0.1
Ubuntu 18.04 LTS:
node-hawk 6.0.1+dfsg-1+deb10u1build0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6116-1
CVE-2022-29167
Package Information:
https://launchpad.net/ubuntu/+source/node-hawk/8.0.1+dfsg-1ubuntu0.22.10.1
https://launchpad.net/ubuntu/+source/node-hawk/8.0.1+dfsg-1ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/node-hawk/7.1.2+dfsg-1ubuntu0.1
https://launchpad.net/ubuntu/+source/node-hawk/6.0.1+dfsg-1+deb10u1build0.18.04.1
Related news
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead.`Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.