CVE-2022-0155: Cookie header not cleared upon cross-domain redirect

[mateusbandeiraa]

Describe the bug

Axios depends on follow-redirects version 1.14.4.

There's a CVE that allows cookie exposure through redirects (described here). This CVE was fixed in follow-redirects v1.14.17.

To Reproduce

Run a vulnerability scan

Expected behavior

Depend on follow-redirects v1.14.17 or later.

Environment

Additional context/Screenshots

Related: follow-redirects/follow-redirects#183

[github-actions]

Hello! 👋

This issue is being automatically closed because it does not follow the issue template. Please read the issue template carefully and follow all of the instructions when opening a new issue.

Thanks

[mateusbandeiraa]

@jasonsaayman I edited the original issue. Can we reopen this instead of creating a duplicate?

[mateusbandeiraa]

#4379 addresses this issue.