node-axios: CVE-2023-45857

Debian Bug report logs - #1056099
node-axios: CVE-2023-45857

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: node-axios: CVE-2023-45857

Date: Thu, 16 Nov 2023 22:04:57 +0100

Source: node-axios
Version: 1.5.1+dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/axios/axios/issues/6006
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for node-axios.

CVE-2023-45857[0]:
| An issue discovered in Axios 1.5.1 inadvertently reveals the
| confidential XSRF-TOKEN stored in cookies by including it in the
| HTTP header X-XSRF-TOKEN for every request made to any host allowing
| attackers to view sensitive information.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-45857
    https://www.cve.org/CVERecord?id=CVE-2023-45857
[1] https://github.com/axios/axios/issues/6006
[2] https://github.com/axios/axios/commit/96ee232bd3ee4de2e657333d4d2191cd389e14d0

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #8 received at 1056099-submitter@bugs.debian.org (full text, mbox, reply):

From: Yadd <noreply@salsa.debian.org>

To: 1056099-submitter@bugs.debian.org

Subject: Bug#1056099 marked as pending in node-axios

Date: Fri, 17 Nov 2023 10:52:30 +0000

Control: tag -1 pending

Hello,

Bug #1056099 in node-axios reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-axios/-/commit/cedde7396c4efd3f42204e3c63495db06fd6be52

------------------------------------------------------------------------
New upstream version (Closes: #1056099, CVE-2023-45857)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1056099

Message #13 received at 1056099-submitter@bugs.debian.org (full text, mbox, reply):

From: Yadd <noreply@salsa.debian.org>

To: 1056099-submitter@bugs.debian.org

Subject: Bug#1056099 marked as pending in node-axios

Date: Fri, 17 Nov 2023 10:52:31 +0000

Control: tag -1 pending

Hello,

Bug #1056099 in node-axios reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-axios/-/commit/cedde7396c4efd3f42204e3c63495db06fd6be52

------------------------------------------------------------------------
New upstream version (Closes: #1056099, CVE-2023-45857)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1056099

Send a report that this bug log contains spam.