{"id":"CVE-2024-28849","aliases":["AZL-36895","AZL-43861","AZL-44493","CLSA-2026-1774830259","CLSA-2026-1776818198","CLSA-2026-1782176274","CLSA-2026-1782262690","CLSA-2026-1782262692","CLSA-2026-1782262693","CLSA-2026-1792074325","DEBIAN-CVE-2024-28849","EUVD-2024-0907","GHSA-cxjh-pqwp-8mfp","GHSA-r4q5-vmmm-2653","MGASA-2026-0327","RHSA-2024:3781","UBUNTU-CVE-2024-28849","USN-8217-1","openSUSE-SU-2024:13830-1"],"status":"published","title":"Proxy-Authorization header kept across hosts in follow-redirects","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01044,"percentile":0.64382,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-03-14T17:07:27Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"follow-redirects","fixed_in":["1.15.6"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-9"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"follow-redirects","fixed_in":["1.0.0-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-follow-redirects","fixed_in":["1.15.6+~1.14.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-follow-redirects","fixed_in":["1.15.6+~1.14.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.18.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","fixed_in":["1.2.4-1ubuntu0.20.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","fixed_in":["1.14.9+~1.14.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.15.5"},{"fixed":"1.15.6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.3-tuxcare.0"},{"fixed":"0.0.3-tuxcare.1"}]}],"versions":["0.0.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0-tuxcare.0"},{"fixed":"1.0.0-tuxcare.3"}]}],"versions":["1.0.0","1.0.0-tuxcare.1","1.0.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.10-tuxcare.0"},{"fixed":"1.5.10-tuxcare.1"}]}],"versions":["1.5.10"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.5-tuxcare.0"},{"fixed":"1.15.5-tuxcare.1"}]}],"versions":["1.15.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.3-tuxcare.0"},{"fixed":"1.15.3-tuxcare.1"}]}],"versions":["1.15.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.15.2-tuxcare.0"},{"fixed":"1.15.2-tuxcare.1"}]}],"versions":["1.15.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.6-tuxcare.0"},{"fixed":"1.2.6-tuxcare.2"}]}],"versions":["1.2.6","1.2.6-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.11+~1.14.4-1","1.15.11+~1.14.4-2","1.15.2+~1.14.1-1","1.15.3+~1.14.2-1","1.15.6+~1.14.4-1","1.15.6+~1.14.4-2","1.15.9+~1.14.4-1","1.16.0+~1.14.4-1","1.16.0+~1.14.4-2","1.16.1+~1.14.4-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.6+~1.14.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.6+~1.14.4-1"}]}]},{"source":"osv","ecosystem":"npm","package":"follow-redirects","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.15.6"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"python-starlette","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.46.0-3.1.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.7-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.7-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"receptorctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.8-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-cryptography-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-cryptography-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:42.0.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pillow-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pillow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.3.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-gunicorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.0.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-gunicorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.0.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-gunicorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.0.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-gunicorn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.0.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-pydantic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.15-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-pydantic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.15-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-pydantic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.15-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-pydantic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.15-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.0-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-black","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:22.8.0-2.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.5-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-hub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-galaxy-ng","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-social-auth-app-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.1-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-social-auth-app-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.1-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-social-auth-app-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.1-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-social-auth-app-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.1-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.4-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el8ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.32.2-1.el9ap"}]}],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm1"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.18.04.1~esm1"}]}],"versions":["1.2.4-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.20.04.1~esm1"}]}],"versions":["1.2.4-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-follow-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.9+~1.14.1-1ubuntu0.1~esm1"}]}],"versions":["1.13.1-1","1.14.5-1","1.14.7+~1.13.1-1","1.14.8+~1.14.0-1","1.14.9+~1.14.1-1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git74.3426c0a-5.1"}]}],"bundled":2}],"products":[{"vendor":"follow-redirects","product":"follow-redirects"},{"vendor":"follow-redirects_project","product":"follow-redirects"}],"references":[{"url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/psf/requests/issues/1885","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://hackerone.com/reports/2390009","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://fetch.spec.whatwg.org/#authentication-entries","tags":["x_refsource_MISC","x_transferred","Technical Description","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z/","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28849","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cxjh-pqwp-8mfp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28849.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28849","tags":["advisory"]},{"url":"https://github.com/follow-redirects/follow-redirects","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0327.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35637","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWLLKAJQCNBN46LPLDAYBM2FU65WBX72/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00213.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/FET4KWO46IN64G35ZF7HGJJBIM4OF3YC/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3781","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266045","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270236","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272563","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2275106","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2275280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2275989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2277035","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278038","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2282114","tags":["report"]},{"url":"https://issues.redhat.com/browse/AAH-3111","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3781.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5752","tags":["advisory"]},{"url":"https://github.com/pypa/pip/pull/12306","tags":["article"]},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45288","tags":["advisory"]},{"url":"https://nowotarski.info/http2-continuation-flood/","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2687","tags":["advisory"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45290","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45290","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/08/4","tags":["article"]},{"url":"https://go.dev/cl/569341","tags":["article"]},{"url":"https://go.dev/issue/65383","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2599","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0004","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49083","tags":["advisory"]},{"url":"https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a","tags":["article"]},{"url":"https://github.com/pyca/cryptography/pull/9926","tags":["article"]},{"url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jfhm-5ghh-2f97","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-50447","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-50447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50447","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/20/1","tags":["article"]},{"url":"https://devhub.checkmarx.com/cve-details/CVE-2023-50447/","tags":["article"]},{"url":"https://duartecsantos.github.io/2023-01-02-CVE-2023-50447/","tags":["article"]},{"url":"https://github.com/python-pillow/Pillow/releases","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1135","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1135","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w3h3-4rj7-4ph4","tags":["advisory"]},{"url":"https://github.com/benoitc/gunicorn/commit/ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d","tags":["article"]},{"url":"https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3651","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-3772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-3772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3772","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2m57-hf25-phgg","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21503","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21503","tags":["advisory"]},{"url":"https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8","tags":["article"]},{"url":"https://github.com/psf/black/releases/tag/24.3.0","tags":["article"]},{"url":"https://security.snyk.io/vuln/SNYK-PYTHON-BLACK-6256273","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24783","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3q2c-pvp5-3cqp","tags":["advisory"]},{"url":"https://go.dev/cl/569339","tags":["article"]},{"url":"https://go.dev/issue/65390","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2024-2598","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240329-0005","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26130","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27306","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27306","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-27351","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-27351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27351","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/mar/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28219","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28219","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28849","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28849","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-30251","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-30251","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30251","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5m98-qgg9-wh84","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2024/05/02/4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32879","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32879","tags":["advisory"]},{"url":"https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34064","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-35195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-35195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195","tags":["advisory"]},{"url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2024-28849","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8217-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-0155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-26159","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28849","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-28849","title":"Proxy-Authorization header kept across hosts in follow-redirects","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:07:27.338Z","modified":"2025-02-13T17:47:32.862Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-0907","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:07:27Z","modified":"2025-02-13T17:47:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"ghsa":[{"id":"GHSA-cxjh-pqwp-8mfp","title":"follow-redirects' Proxy-Authorization header kept across hosts","description":"When using [axios](https://github.com/axios/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.\n\n## Steps To Reproduce \u0026 PoC\n\nTest code:\n\n```js\nconst axios = require('axios');\n\naxios.get('http://127.0.0.1:10081/', {\n headers: {\n 'AuThorization': 'Rear Test',\n 'ProXy-AuthoriZation': 'Rear Test',\n 'coOkie': 't=1'\n }\n})\n .then((response) =\u003e {\n console.log(response);\n })\n```\n\nWhen I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.\n\n## Impact\n\nThis vulnerability may lead to credentials leak.\n\n## Recommendations\n\nRemove proxy-authentication header during cross-domain redirect\n\n### Recommended Patch\n\n[follow-redirects/index.js:464](https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b)\n\n```diff\n- removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);\n+ removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers);\n```","status":"published","published":"2024-03-14T17:19:42Z","modified":"2024-04-02T17:54:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"nvd":[{"id":"CVE-2024-28849","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:15:52.097Z","modified":"2026-06-17T07:21:53.207Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:09:40.831473Z"}],"osv":[{"id":"CVE-2024-28849","title":"Proxy-Authorization header kept across hosts in follow-redirects","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:07:27.338Z","modified":"2026-10-28T02:30:26.775998923Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-28849","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:15:52.097Z","modified":"2026-11-02T12:01:31.282287547Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-cxjh-pqwp-8mfp","title":"follow-redirects' Proxy-Authorization header kept across hosts","description":"When using [axios](https://github.com/axios/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.\n\n## Steps To Reproduce \u0026 PoC\n\nTest code:\n\n```js\nconst axios = require('axios');\n\naxios.get('http://127.0.0.1:10081/', {\n headers: {\n 'AuThorization': 'Rear Test',\n 'ProXy-AuthoriZation': 'Rear Test',\n 'coOkie': 't=1'\n }\n})\n .then((response) =\u003e {\n console.log(response);\n })\n```\n\nWhen I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.\n\n## Impact\n\nThis vulnerability may lead to credentials leak.\n\n## Recommendations\n\nRemove proxy-authentication header during cross-domain redirect\n\n### Recommended Patch\n\n[follow-redirects/index.js:464](https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b)\n\n```diff\n- removeMatchingHeaders(/^(?:authorization|cookie)$/i, this._options.headers);\n+ removeMatchingHeaders(/^(?:authorization|proxy-authorization|cookie)$/i, this._options.headers);\n```","status":"published","published":"2024-03-14T17:19:42Z","modified":"2026-09-10T03:50:10.249526628Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"RHSA-2024:3781","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2024-10-02T11:01:59Z","modified":"2026-10-17T10:03:21Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2024-28849","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:15:00Z","modified":"2026-04-29T10:39:40.845848Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-36895","title":"CVE-2024-28849 affecting package reaper for versions less than 3.1.1-9","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:15:52Z","modified":"2026-04-21T04:25:17.104584Z","updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-43861","title":"CVE-2024-28849 affecting package js-jquery 3.5.0-4","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:15:52Z","modified":"2026-04-21T04:31:11.636765Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44493","title":"CVE-2024-28849 affecting package js-jquery 3.5.0-4","description":"follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-03-14T17:15:52Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CLSA-2026-1774830259","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 0.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-15T09:47:48.690741988Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1776818198","title":"TuxCare security update for follow-redirects (1 CVE)","description":"TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 1.0.0-tuxcare.3.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:45:47.067382173Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1782176274","title":"TuxCare security update for follow-redirects (5 CVEs)","description":"TuxCare rebuilt follow-redirects to address 5 CVEs. Fixed in 1.5.10-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.323495469Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262690","title":"TuxCare security update for follow-redirects (3 CVEs)","description":"TuxCare rebuilt follow-redirects to address 3 CVEs. Fixed in 1.15.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:10.025277439Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262692","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.993398018Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262693","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.15.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:09.993368244Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1792074325","title":"TuxCare security update for follow-redirects (4 CVEs)","description":"TuxCare rebuilt follow-redirects to address 4 CVEs. Fixed in 1.2.6-tuxcare.2.","status":"published","published":"2026-10-15T14:25:25Z","modified":"2026-10-15T19:00:11.997374602Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"MGASA-2026-0327","title":"Updated python-starlette package fixes security vulnerabilities","description":"The updated package fixes security vulnerabilities:\nProxy-Authorization header kept across hosts. (CVE-2024-28849)\nStarlette vulnerable to O(n^2) DoS via Range header merging in\nstarlette.responses.FileResponse. (CVE-2025-62727)\nSecurity restriction bypass via malformed HTTP Host header.\n(CVE-2026-48710)\n","status":"published","published":"2026-08-09T06:02:53Z","modified":"2026-08-09T06:15:05.185054852Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2024:13830-1","title":"system-user-velociraptor-1.0.0-5.1 on GA media","description":"These are all security issues fixed in the system-user-velociraptor-1.0.0-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:04:59.203254Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"USN-8217-1","title":"node-follow-redirects vulnerabilities","description":"It was discovered that follow-redirects did not properly protect sensitive\nuser information during redirects. An attacker could possibly use this\nissue to expose sensitive information. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0155)\n\nIt was discovered that follow-redirects did not properly remove sensitive\ninformation before storage or transfer. An attacker could possibly use this\nissue to expose sensitive information. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0536)\n\nIt was discovered that follow-redirects did not properly validate URLs when\nhandling certain inputs. An attacker could possibly use this issue to\nredirect users to a malicious site, resulting in information disclosure or\nphishing attacks. (CVE-2023-26159)\n\nIt was discovered that follow-redirects did not properly clear proxy\nauthentication headers during cross-domain redirects. An attacker could\npossibly use this issue to cause exposure of sensitive credentials.\n(CVE-2024-28849)","status":"published","published":"2026-04-28T13:57:04Z","modified":"2026-04-29T10:45:17.150695519Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}