[FREEBSD:B9210706-FEB0-11EC-81FA-1C697A616631] Node.js -- July 7th 2022 Security Releases

Node.js reports:

  HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding
  (Medium)(CVE-2022-32213)
  The llhttp parser in the http module does not correctly parse and
  validate Transfer-Encoding headers. This can lead to HTTP Request
  Smuggling (HRS).
  HTTP Request Smuggling - Improper Delimiting of Header Fields
  (Medium)(CVE-2022-32214)
  The llhttp parser in the http module does not strictly use the CRLF
  sequence to delimit HTTP requests. This can lead to HTTP Request
  Smuggling (HRS).
  HTTP Request Smuggling - Incorrect Parsing of Multi-line
  Transfer-Encoding (Medium)(CVE-2022-32215)
  The llhttp parser in the http module does not correctly handle
  multi-line Transfer-Encoding headers. This can lead to HTTP Request
  Smuggling (HRS).
  DNS rebinding in --inspect via invalid IP addresses
  (High)(CVE-2022-32212)
  The IsAllowedHost check can easily be bypassed because IsIPAddress
  does not properly check if an IP address is invalid or not. When an
  invalid IPv4 address is provided (for instance 10.0.2.555 is
  provided), browsers (such as Firefox) will make DNS requests to the
  DNS server, providing a vector for an attacker-controlled DNS server
  or a MITM who can spoof DNS responses to perform a rebinding attack
  and hence connect to the WebSocket debugger, allowing for arbitrary
  code execution. This is a bypass of CVE-2021-22884.
  Attempt to read openssl.cnf from /home/iojs/build/ upon startup
  (Medium)(CVE-2022-32222)
  When Node.js starts on linux based systems, it attempts to read
  /home/iojs/build/ws/out/Release/obj.target/deps/openssl/openssl.cnf,
  which ordinarily doesn't exist. On some shared systems an attacker may
  be able create this file and therefore affect the default OpenSSL
  configuration for other users.
  OpenSSL - AES OCB fails to encrypt some bytes
  (Medium)(CVE-2022-2097)
  AES OCB mode for 32-bit x86 platforms using the AES-NI assembly
  optimised implementation will not encrypt the entirety of the data
  under some circumstances. This could reveal sixteen bytes of data that
  was preexisting in the memory that wasn't written. In the special case
  of "in place" encryption, sixteen bytes of the plaintext would be
  revealed.  Since OpenSSL does not support OCB based cipher suites for
  TLS and DTLS, they are both unaffected.