Bug 1222530 (CVE-2024-30260) - VUL-0: CVE-2024-30260: nodejs, nodejs-electron: undici: proxy-authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Summary: VUL-0: CVE-2024-30260: nodejs, nodejs-electron: undici: proxy-authorization h...
Status: IN_PROGRESS
Alias: CVE-2024-30260
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/400392/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-30260:3.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-09 10:03 UTC by SMASH SMASH
Modified: 2024-07-12 15:20 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-04-09 10:03:12 UTC 
Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-30260
https://www.cve.org/CVERecord?id=CVE-2024-30260
https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f
https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75
https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
https://bugzilla.redhat.com/show_bug.cgi?id=2273522
Comment 2 Camila Camargo de Matos 2024-04-09 10:17:53 UTC 
Commit 64e3402d contains the fix for undici versions 5.x, while commit 68057466 contains the fix for 6.11.0.
Comment 3 Bruno Pitrus 2024-04-09 16:39:16 UTC 
commit 64e3402d also contains a giant refactor that is impossible to backport due to an amalgamated version of undici being present in the nodejs tree…

Looks like just adding 'proxy-authorization' below the previous two headers should be a simpler fix.
Comment 4 Adam Majer 2024-04-10 08:12:12 UTC 
(In reply to Bruno Pitrus from comment #3)
> commit 64e3402d also contains a giant refactor that is impossible to
> backport due to an amalgamated version of undici being present in the nodejs
> tree…
> 
> Looks like just adding 'proxy-authorization' below the previous two headers
> should be a simpler fix.

Sadly it's generated code and the src/ in node tree is just for reference :(

The simplest is to do a version update by applying https://github.com/nodejs/node/pull/52328

This version update also fixes CVE-2024-30261 via 
https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672
Comment 5 OBSbugzilla Bot 2024-04-10 09:35:05 UTC 
This is an autogenerated message for OBS integration:
This bug (1222530) was mentioned in
https://build.opensuse.org/request/show/1166607 Factory / nodejs21
Comment 6 OBSbugzilla Bot 2024-04-10 11:35:07 UTC 
This is an autogenerated message for OBS integration:
This bug (1222530) was mentioned in
https://build.opensuse.org/request/show/1166624 Factory / nodejs20
Comment 7 Bruno Pitrus 2024-04-10 13:44:57 UTC 
Pulling bulk update commits probably won't help for electron because their copy of node does not match the head of the relevant node branch.
Comment 8 Adam Majer 2024-04-11 08:22:52 UTC 
(In reply to Bruno Pitrus from comment #7)
> Pulling bulk update commits probably won't help for electron because their
> copy of node does not match the head of the relevant node branch.

In this case, it's best to just wait for upstream to update. Electron is not really affected here anyway, as this is mostly server related issue.
Comment 10 Maintenance Automation 2024-04-16 08:30:04 UTC 
SUSE-SU-2024:1301-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1220053, 1222244, 1222384, 1222530, 1222603
CVE References: CVE-2024-24806, CVE-2024-27982, CVE-2024-27983, CVE-2024-30260, CVE-2024-30261
Maintenance Incident: [SUSE:Maintenance:33347](https://smelt.suse.de/incident/33347/)
Sources used:
Web and Scripting Module 15-SP5 (src):
 nodejs20-20.12.1-150500.11.9.2
openSUSE Leap 15.5 (src):
 nodejs20-20.12.1-150500.11.9.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2024-04-16 12:30:08 UTC 
SUSE-SU-2024:1309-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1220053, 1222244, 1222384, 1222530, 1222603
CVE References: CVE-2024-24806, CVE-2024-27982, CVE-2024-27983, CVE-2024-30260, CVE-2024-30261
Maintenance Incident: [SUSE:Maintenance:33350](https://smelt.suse.de/incident/33350/)
Sources used:
openSUSE Leap 15.4 (src):
 nodejs18-18.20.1-150400.9.21.3
openSUSE Leap 15.5 (src):
 nodejs18-18.20.1-150400.9.21.3
Web and Scripting Module 15-SP5 (src):
 nodejs18-18.20.1-150400.9.21.3
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 nodejs18-18.20.1-150400.9.21.3
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 nodejs18-18.20.1-150400.9.21.3
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 nodejs18-18.20.1-150400.9.21.3
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 nodejs18-18.20.1-150400.9.21.3
SUSE Manager Server 4.3 (src):
 nodejs18-18.20.1-150400.9.21.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Maintenance Automation 2024-04-16 12:30:13 UTC 
SUSE-SU-2024:1307-1: An update that solves five vulnerabilities can now be installed.

Category: security (important)
Bug References: 1220053, 1222244, 1222384, 1222530, 1222603
CVE References: CVE-2024-24806, CVE-2024-27982, CVE-2024-27983, CVE-2024-30260, CVE-2024-30261
Maintenance Incident: [SUSE:Maintenance:33351](https://smelt.suse.de/incident/33351/)
Sources used:
Web and Scripting Module 12 (src):
 nodejs18-18.20.1-8.21.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 21 Maintenance Automation 2024-05-29 16:30:08 UTC 
SUSE-SU-2024:1837-1: An update that solves two vulnerabilities can now be installed.

Category: security (low)
Bug References: 1222530, 1222603
CVE References: CVE-2024-30260, CVE-2024-30261
Maintenance Incident: [SUSE:Maintenance:34067](https://smelt.suse.de/incident/34067/)
Sources used:
openSUSE Leap 15.4 (src):
 nodejs16-16.20.2-150400.3.36.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 22 Maintenance Automation 2024-05-29 16:30:11 UTC 
SUSE-SU-2024:1836-1: An update that solves two vulnerabilities can now be installed.

Category: security (low)
Bug References: 1222530, 1222603
CVE References: CVE-2024-30260, CVE-2024-30261
Maintenance Incident: [SUSE:Maintenance:34069](https://smelt.suse.de/incident/34069/)
Sources used:
Web and Scripting Module 12 (src):
 nodejs16-16.20.2-8.45.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.