CVE-2020-11021
Summary
| CVE | CVE-2020-11021 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-04-29 18:15:00 UTC |
| Updated | 2021-09-14 14:02:00 UTC |
| Description | Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Http-client Project | Http-client | All | All | All | All |
| Application | Http-client Project | Http-client | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Redirects should not pass authorization to different domain by bryanmacfarlane · Pull Request #27 · actions/http-client · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Http request which redirect to another hostname do not strip authorization header · Advisory · actions/http-client · GitHub | CONFIRM | github.com | Third Party Advisory |
| Merge pull request #27 from actions/redirect-auth-issue · actions/http-client@f6aae3d · GitHub | MISC | github.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981495 Nodejs (npm) Security Update for @actions/http-client (GHSA-9w6v-m7wp-jwg4)