Most recent entries from all

bdu:2024-02610

certfr-2024-avi-0330 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0330

EUVD-2026-217371

fkie_cve-2024-28849

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-cxjh-pqwp-8mfp — follow-redirects' Proxy-Authorization header kept across hosts

Affected: npm: follow-redirects

When using [axios](https://github.com/axios/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.

## Steps To Reproduce & PoC

Test code:

```js const axios = require('axios');

axios.get('http://127.0.0.1:10081/', { headers: { 'AuThorization': 'Rear Test', 'ProXy-AuthoriZation': 'Rear Test', 'coOkie': 't=1' } }) .then((response) => { console.log(response); }) ```

When I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.

## Impact

This vulnerability may lead to credentials leak.

## Recommendations

Remove proxy-authentication header during cross-domain redirect

### Recommended Patch

[follow-redirects/index.js:464](https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b)

```diff - removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers); + removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers); ```

gsd-2024-28849

msrc_CVE-2024-28849 — Proxy-Authorization header kept across hosts in follow-redirects

msrc_CVE-2024-28849

openSUSE-SU-2024:13830-1 — system-user-velociraptor-1.0.0-5.1 on GA media

system-user-velociraptor-1.0.0-5.1 on GA media

RHBA-2024:2034 — Red Hat Bug Fix Advisory: Red Hat Advanced Cluster Management 2.10.2 bug fixes and container updates

follow-redirects: Possible credential leak

UBUNTU-CVE-2024-28849

Affected: Ubuntu:Pro:18.04:LTS: node-follow-redirects, Ubuntu:Pro:20.04:LTS: node-follow-redirects, Ubuntu:Pro:22.04:LTS: node-follow-redirects

WID-SEC-W-2024-0858 — IBM QRadar SIEM: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Phishing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen oder vertrauliche Informationen offenzulegen.