Undici proxy-authorization header not cleared on cross-origin redirect in fetch #412

New issue

Closed

opened 2024-02-20 17:09:26 +00:00 by Vylpes · 1 comment

Vylpes commented

2024-02-20 17:09:26 +00:00

Owner

Package: undici (npm)
Affected versions: <= 5.28.2
Patched version: 5.28.3

Impact

Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers.

Patches

This is patched in v5.28.3 and v6.6.1

Workarounds

There are no known workarounds.

References

Package: undici (npm) Affected versions: <= 5.28.2 Patched version: 5.28.3 --- ## Impact Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authorization headers. ## Patches This is patched in v5.28.3 and v6.6.1 ## Workarounds There are no known workarounds. ## References - https://fetch.spec.whatwg.org/#authentication-entries - [GHSA-wqq4-5wpv-mx2g](https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g)

Vylpes added the

type

dependencies

label 2024-02-20 17:09:34 +00:00

Vylpes commented

2024-02-20 17:10:18 +00:00

Author

Owner

Dependabot cannot update undici to a non-vulnerable version

The latest possible version that can be installed is 5.27.2 because of the following conflicting dependencies:

@discordjs/rest@2.2.0 requires undici@5.27.2
discord.js@14.14.1 requires undici@5.27.2 via a transitive dependency on @discordjs/rest@2.1.0
discord.js@14.14.1 requires undici@5.27.2

The earliest fixed version is 5.28.3.

**Dependabot cannot update undici to a non-vulnerable version** The latest possible version that can be installed is `5.27.2` because of the following conflicting dependencies: ``` @discordjs/rest@2.2.0 requires undici@5.27.2 discord.js@14.14.1 requires undici@5.27.2 via a transitive dependency on @discordjs/rest@2.1.0 discord.js@14.14.1 requires undici@5.27.2 ``` The earliest fixed version is `5.28.3`.

Vylpes added this to the 3.2.1 milestone 2024-02-20 17:10:43 +00:00

Vylpes self-assigned this 2024-03-01 17:27:32 +00:00

Vylpes started working 2024-03-01 17:27:35 +00:00

Vylpes stopped working 2024-03-01 17:31:41 +00:00

4 minutes 6 seconds

Vylpes closed this issue

2024-03-01 17:31:43 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Total time spent: 4 minutes 6 seconds

Vylpes

4 minutes 6 seconds

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: RabbitLabs/vylbot-app#412

No description provided.