low3.9
CVE-2024-30260
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Impact
### Impact Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. ### Patches This has been patched in https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75. Fixes has been released in v5.28.4 and v6.11.1. ### Workarounds use `fetch()` or disable `maxRedirections`. ### References Linzi Shang reported this. * https://hackerone.com/reports/2408074 * https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | undici | < 5.28.4 | 5.28.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodejs | Undici | before 5.28.4 from 6.0.0 before 6.11.1 |
| Fedoraproject | Fedora | Versions 38, 39, 40 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nodejs/undici/commit/64e3402da4e032e68de46acb52800c9a06aaea3f
- https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75
- https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E/
- https://security.netapp.com/advisory/ntap-20240905-0008/
- https://github.com/advisories/GHSA-m4v8-wqvr-p9f7
- https://hackerone.com/reports/2408074
- https://nvd.nist.gov/vuln/detail/CVE-2024-30260
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HQVHWAS6WDXXIU7F72XI55VZ2LTZUB33
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC3V3HFZ5MOJRZDY5ZELL6REIRSPFROJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P6Q4RGETHVYVHDIQGTJGU5AV6NJEI67E
- https://security.netapp.com/advisory/ntap-20240905-0008