Sensitive Data Exposure in node-follow-redirects: CVE-2022-0155
Summary
CVE-2022-0155: follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Affects node-follow-redirects across 2 version ranges.
< 1.13.1-1+deb11u1
< 8b347cbcef7c7b72a6e9be20f5710c17d6163c22
Fixed in 1.13.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-follow-redirects is a popular Node.js library that simplifies the handling of HTTP redirects. It allows developers to easily follow HTTP redirects in their applications, enhancing usability and functionality. However, it has been identified to have a vulnerability that exposes private personal information to unauthorized actors, raising significant security concerns.
Vulnerability Detail
CVE-2022-0155 is a vulnerability in the node-follow-redirects package that allows unauthorized actors to access private personal information. This vulnerability arises from improper handling of redirects, which can lead to sensitive data being exposed. The potential ramifications include data breaches and unauthorized access to user information, which can have severe implications for user privacy and security.
How To Fix
Minimum fixed version
1.13.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-follow-redirectsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing additional security measures such as input validation and sanitization to mitigate the risk of data exposure until the package can be updated.
Conclusion
The CVE-2022-0155 vulnerability in the node-follow-redirects package poses a significant risk of exposing private personal information. It is crucial for developers using this package to update to the latest version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-follow-redirects →
FAQ
CVE-2022-0155 is a vulnerability in the node-follow-redirects package that exposes private personal information to unauthorized actors.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-0155 is 6.5, indicating a medium severity level.
If you cannot update the package, implement additional security measures such as input validation and sanitization to reduce the risk of data exposure.
More information about node-follow-redirects can be found on its GitHub repository at https://github.com/follow-redirects/follow-redirects.
Related vulnerabilities
Recent vulnerabilities recorded for node-follow-redirects.
