Skip to content
OpenAdvisories
High · 8.0 Public exploit CVE-2022-0155 EUVD-2022-0494GHSA-74fj-2j2h-c42q

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

Published Jan 10, 2022 · Updated Aug 2, 2024 · Assigned by @huntrdev

Vendor: follow-redirects Product: follow-redirects/follow-redirects Package: follow-redirects Package: js-jquery Package: node-follow-redirects Package: node-follow-redirects Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: npm Ecosystem: Ubuntu

Description

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Affected products

VendorProductAffectedFixed
follow-redirects follow-redirects/follow-redirects unspecified – < 1.14.7 1.14.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 node-follow-redirects 1.14.7+~1.13.1-1 —
Debian 13 node-follow-redirects 1.14.7+~1.13.1-1 —
Debian 12 node-follow-redirects 1.14.7+~1.13.1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS node-follow-redirects 1.14.9+~1.14.1-1ubuntu0.1~esm1 USN-8217-1
Ubuntu Pro 20.04 LTS node-follow-redirects 1.2.4-1ubuntu0.20.04.1~esm1 USN-8217-1
Ubuntu Pro 18.04 LTS node-follow-redirects 1.2.4-1ubuntu0.18.04.1~esm1 USN-8217-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Rhev Manager 4 ovirt-engine-dwh +2 4.5.7-1.el8ev RHSA-2022:8502
Red Hat Rhev Manager 4 ovirt-engine-ui-extensions 1.3.6-1.el8ev RHSA-2022:8502
Red Hat Rhev Manager 4 ovirt-web-ui 1.9.2-1.el8ev RHSA-2022:8502
Red Hat Rhev Manager 4 rhvm +19 4.5.3.2-1.el8ev RHSA-2022:8502

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 grafana 9.5.1-150200.3.41.3 SUSE-SU-2023:2575-1, SUSE-RU-2024:0511-1
SLES 15 SP4 grafana 9.5.1-150200.3.41.3 SUSE-SU-2023:2575-1
SLES 15 SP2 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLES 15 SP1 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP2 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLES for SAP 15 SP1 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLE HPC 15 SP2 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLE HPC 15 SP1 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SUSE Manager Server Module 4.3 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1
SUSE Manager Proxy Module 4.3 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1
SUSE Manager Proxy Module 4.3 zypp-plugin-spacewalk 1.0.14-150000.3.35.1 SUSE-SU-2023:2578-1
SUSE Manager Proxy Module 4.2 zypp-plugin-spacewalk 1.0.14-150000.3.35.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-150000.1.50.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-proxy-systemd-services 4.3.10-150000.1.15.1 SUSE-SU-2024:0487-1
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1681904360.84ef141-150000.1.50.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-159000.4.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-150000.3.53.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 9.5.1-150000.1.48.5 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 mgr-daemon 4.3.7-150000.1.41.1 SUSE-SU-2024:0487-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 mgr-push 5.0.1-159000.4.21.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.1-150000.1.17.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 5.0.1-159000.6.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 spacecmd 4.3.21-150000.3.98.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 spacewalk-client-tools 4.3.18-150000.3.86.2 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-common-libs 4.3.8-150000.1.33.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 4.3.10-150000.1.15.1 SUSE-SU-2024:0487-1, SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 zypp-plugin-spacewalk 1.0.14-150000.3.35.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-4.6.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-4.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-1.21.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-1.24.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.5.0-4.15.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-1.50.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 9.5.1-1.48.1 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1687520761.cefb248-4.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 mgr-daemon 4.3.7-1.41.1 SUSE-SU-2024:0486-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12 mgr-push 5.0.1-4.21.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.24.0-3.6.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.1-1.17.2 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-15.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 rhnlib 5.0.1-24.30.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 spacecmd 4.3.21-38.121.1 SUSE-SU-2024:0486-1, SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12 spacewalk-client-tools 4.3.18-52.95.2 SUSE-SU-2024:0486-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.2-9.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.1-9.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 4.3.8-1.33.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12 zypp-plugin-spacewalk 1.0.14-30.42.1 SUSE-SU-2023:2579-1
SUSE Enterprise Storage 7 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 9.3.6-1.1 openSUSE-SU-2024:12723-1
openSUSE Leap 15.5 dracut-saltboot 0.1.1681904360.84ef141-150000.1.50.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.5 golang-github-lusitaniae-apache_exporter 1.0.0-150000.1.20.1 SUSE-SU-2024:0487-1
openSUSE Leap 15.5 grafana 9.5.1-150200.3.41.3 SUSE-SU-2023:2575-1, SUSE-RU-2024:0511-1
openSUSE Leap 15.5 prometheus-postgres_exporter 0.10.1-150000.1.17.1 SUSE-SU-2024:0487-1
openSUSE Leap 15.5 spacecmd 4.3.21-150000.3.98.1 SUSE-SU-2024:0487-1, SUSE-SU-2023:2578-1
openSUSE Leap 15.5 wire 0.5.0-150000.1.12.3 SUSE-SU-2023:2578-1
openSUSE Leap 15.4 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.4 dracut-saltboot 0.1.1681904360.84ef141-150000.1.50.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.4 grafana 9.5.1-150200.3.41.3 SUSE-SU-2023:2575-1
openSUSE Leap 15.4 spacecmd 4.3.21-150000.3.98.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.4 wire 0.5.0-150000.1.12.3 SUSE-SU-2023:2578-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 js-jquery No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm follow-redirects < 1.14.7 1.14.7 GHSA-74fj-2j2h-c42q

Advisories 16

References