Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-24758

HistoryFeb 16, 2024 - 10:15 p.m.

CVE-2024-24758

2024-02-1622:15:08

Debian Security Bug Tracker

security-tracker.debian.org

undici

http/1.1

client

vulnerability

patched

versions

5.28.3

6.6.1

upgrade

cross-origin

redirects

proxy-authentication

headers

node.js

vulnerability

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.1%

JSON

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear Proxy-Authentication headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

OSVersionArchitecturePackageVersionFilename
Debian12allnode-undici<= 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3node-undici_5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3_all.deb
Debian999allnode-undici< 5.28.4+dfsg1+~cs23.12.11-1node-undici_5.28.4+dfsg1+~cs23.12.11-1_all.deb
Debian13allnode-undici< 5.28.4+dfsg1+~cs23.12.11-1node-undici_5.28.4+dfsg1+~cs23.12.11-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	node-undici	<= 5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3	node-undici_5.15.0+dfsg1+~cs20.10.9.3-1+deb12u3_all.deb
Debian	999	all	node-undici	< 5.28.4+dfsg1+~cs23.12.11-1	node-undici_5.28.4+dfsg1+~cs23.12.11-1_all.deb
Debian	13	all	node-undici	< 5.28.4+dfsg1+~cs23.12.11-1	node-undici_5.28.4+dfsg1+~cs23.12.11-1_all.deb