p PatchFirst

CVE-2024-28849

CVE-2024-28849 · Proxy-Authorization header kept across hosts in follow-redirects

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 6.5 · Media · EPSS 1,0% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system · node

Productos y versiones afectados

  • follow-redirects

    Versiones
    • < 1.15.6: Afectada

    Sin corrección publicada

  • node-follow-redirects Debian:12

    Versiones
    • 1.15.11+~1.14.4-1
    • 1.15.11+~1.14.4-2
    • 1.15.2+~1.14.1-1
    • 1.15.3+~1.14.2-1
    • 1.15.6+~1.14.4-1
    • 1.15.6+~1.14.4-2
    • 1.15.9+~1.14.4-1
    • 1.16.0+~1.14.4-1
    • 1.16.0+~1.14.4-2
    Intervalos de versiones afectados
    • ECOSYSTEM: (−∞, +∞)

    Sin corrección publicada

  • node-follow-redirects Debian:13

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.15.6+~1.14.4-1

    Actualiza a 1.15.6+~1.14.4-1

  • node-follow-redirects Debian:14

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.15.6+~1.14.4-1

    Actualiza a 1.15.6+~1.14.4-1

  • follow-redirects npm

    Intervalos de versiones afectados
    • SEMVER: < 1.15.6

    Actualiza a 1.15.6

  • node-follow-redirects Ubuntu:Pro:18.04:LTS

    Versiones
    • 1.2.4-1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.2.4-1ubuntu0.18.04.1~esm1

    Actualiza a 1.2.4-1ubuntu0.18.04.1~esm1

  • node-follow-redirects Ubuntu:Pro:20.04:LTS

    Versiones
    • 1.2.4-1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.2.4-1ubuntu0.20.04.1~esm1

    Actualiza a 1.2.4-1ubuntu0.20.04.1~esm1

  • node-follow-redirects Ubuntu:Pro:22.04:LTS

    Versiones
    • 1.13.1-1
    • 1.14.5-1
    • 1.14.7+~1.13.1-1
    • 1.14.8+~1.14.0-1
    • 1.14.9+~1.14.1-1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.14.9+~1.14.1-1ubuntu0.1~esm1

    Actualiza a 1.14.9+~1.14.1-1ubuntu0.1~esm1

Fuentes originales

Comprueba tu servidor →