CVE-2022-0235

node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)

• node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

• express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)

• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)
• node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
• express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.6.3-tuxcare.1.

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1.

TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 1.7.3-tuxcare.1.

TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.

TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.1.2-tuxcare.1.

Root has patched CVE-2022-0235 in the @rootio/node-fetch package for Root:npm. Multiple fixed versions available.

This update for nodejs14 fixes the following issues:

• CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs12 fixes the following issues:

• CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs14 fixes the following issues:

• CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs12 fixes the following issues:

• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs8 fixes the following issues:

• CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
• CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
• CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).

This update for nodejs10 fixes the following issues:

• CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
• CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
• CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
• CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
• CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
• CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).
• CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
• CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
• CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).

It was discovered that Node Fetch incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information.