Summary
It was discovered that follow-redirects did not properly protect sensitive
user information during redirects. An attacker could possibly use this
issue to expose sensitive information. This issue only affected Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155)
It was discovered that follow-redirects did not properly remove sensitive
information before storage or transfer. An attacker could possibly use this
issue to expose sensitive information. This issue only affected Ubuntu
18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536)
It was discovered that follow-redirects did not properly validate URLs when
handling certain inputs. An attacker could possibly use this issue to
redirect users to a malicious site, resulting in information disclosure or
phishing attacks. (CVE-2023-26159)
It was discovered that follow-redirects did not properly clear proxy
authentication headers during cross-domain redirects. An attacker could
possibly use this issue to cause exposure of sensitive credentials.
(CVE-2024-28849)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | node-follow-redirects | 1.2.4-1ubuntu0.18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | node-follow-redirects | 1.2.4-1ubuntu0.20.04.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | node-follow-redirects | 1.14.9+~1.14.1-1ubuntu0.1~esm1 |
Vulnerabilities 4
-
High 8.0CVE-2022-0155 Public exploit
Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
-
High 7.3
Follow Redirects improperly handles URLs in the url.parse() function
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacke…
-
Medium 6.5
Proxy-Authorization header kept across hosts in follow-redirects
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…
-
Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.