CVE-2024-28849 (Medium) detected in follow-redirects-1.15.5.tgz, follow-redirects-1.5.10.tgz - autoclosed #374
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
CVE-2024-28849 - Medium Severity Vulnerability
Vulnerable Libraries - follow-redirects-1.15.5.tgz, follow-redirects-1.5.10.tgz
follow-redirects-1.15.5.tgz
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.5.tgz
Path to dependency file: /core/jazz_metrics/package.json
Path to vulnerable library: /core/jazz_metrics/node_modules/follow-redirects/package.json,/builds/jazz_azure-create-service/node_modules/@azure/ms-rest-js/node_modules/follow-redirects/package.json,/templates/react-website-template/app/node_modules/follow-redirects/package.json
Dependency Hierarchy:
follow-redirects-1.5.10.tgz
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz
Path to dependency file: /builds/jazz_azure-create-service/package.json
Path to vulnerable library: /builds/jazz_azure-create-service/node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in HEAD commit: 712665b267203375ee4b15e1f8d1ebe08abc1547
Found in base branch: develop
Vulnerability Details
follow-redirects is an open source, drop-in replacement for Node's
http
andhttps
modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.Publish Date: 2024-03-14
URL: CVE-2024-28849
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-cxjh-pqwp-8mfp
Release Date: 2024-03-14
Fix Resolution: follow-redirects - 1.15.6
The text was updated successfully, but these errors were encountered: