Bug 1221453 - VUL-0: CVE-2024-28849: nodejs8,nodejs10,nodejs12,nodejs18,nodejs20,nodejs21,nodejs-underscore: follow-redirects: possible credential leak
Summary: VUL-0: CVE-2024-28849: nodejs8,nodejs10,nodejs12,nodejs18,nodejs20,nodejs21,n...
Status: RESOLVED INVALID
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/397689/
Whiteboard:
Keywords:
Depends on:
Blocks: CVE-2024-28849
  Show dependency treegraph
 
Reported: 2024-03-15 09:31 UTC by Andrea Mattiazzo
Modified: 2024-04-19 12:56 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrea Mattiazzo 2024-03-15 09:31:49 UTC
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28849
https://www.cve.org/CVERecord?id=CVE-2024-28849
https://fetch.spec.whatwg.org/#authentication-entries
https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
https://github.com/psf/requests/issues/1885
https://hackerone.com/reports/2390009
https://bugzilla.redhat.com/show_bug.cgi?id=2269576

Patch:
https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b
Comment 1 Andrea Mattiazzo 2024-03-15 09:39:53 UTC
A vulnerable version of follow-redirects are found inside these packages:

openSUSE:Factory/nodejs20                    follow-redirects (1.15.3)
openSUSE:openSUSE:Factory/nodejs21           follow-redirects (1.15.3)   openSUSE:Factory/nodejs-electron             follow-redirects (1.14.8,1.14.9,1.15.2)                                               
openSUSE:Factory/nodejs-underscore           follow-redirects (1.15.2)
SUSE:ALP:Source:Standard:1.0/nodejs20        follow-redirects (1.15.3)
SUSE:SLE-12-SP5:Update/nodejs18              follow-redirects (1.15.3)
SUSE:SLE-12:Update/nodejs10                  follow-redirects (1.0.0,1.4.1)
SUSE:SLE-12:Update/nodejs12                  follow-redirects (1.0.0,1.4.1)                                                 
SUSE:SLE-15-SP2:Update/nodejs8               follow-redirects (1.0.0,1.4.1)                                           
SUSE:SLE-15-SP2:Update/nodejs12              follow-redirects (1.0.0,1.4.1)                                                 
SUSE:SLE-15-SP4:Update/nodejs18              follow-redirects (1.15.3)
SUSE:SLE-15-SP5:Update/nodejs18              follow-redirects (1.15.3)
SUSE:SLE-15-SP5:Update/nodejs20              follow-redirects (1.15.3)
SUSE:SLE-15:Update/nodejs8                   follow-redirects (1.0.0,1.4.1)                                               
SUSE:SLE-15:Update/nodejs10                  follow-redirects (1.0.0,1.4.1)
Comment 2 Bruno Pitrus 2024-03-21 18:56:52 UTC
nodejs-electron: the only copy is at third_party/devtools-frontend/src/node_modules/follow-redirects/index.js and is not shipped (i patched it and it resulted in identical binaries).

Removing it from the list of potentially-affected packages.
Comment 5 Camila Camargo de Matos 2024-04-19 12:56:31 UTC
After further analysis, it was confirmed that the follow-redirects dependency is not actually installed together with the nodejs package in the previously mentioned codestreams. 

Since no packages are affected, the issue will be closed as RESOLVED/INVALID.