Information disclosure in node-fetch - CVE-2022-0235

Vulnerability identifier: #VU61471

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0235

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the application follows the "Location" HTTP header redirect and passes authorization cookie to a third-party resource. A remote attacker can gain access to sensitive information.

node-fetch
IBM Engineering Requirements Quality Assistant
IBM Business Automation Manager Open Editions
Cognos Analytics Mobile (Android)
Cognos Analytics Mobile (iOS)
IBM Planning Analytics Workspace
QRadar Assistant
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
JBoss Data Grid
IBM QRadar Data Synchronization App
IBM Cloud Transformation Advisor
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Automation Manager
IBM Intelligent Operations Center
Red Hat Integration - Service Registry
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
Oracle Linux
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server for SAP
openSUSE Leap
Ubuntu
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
node-fetch (Ubuntu package)
nodejs-nodemon
rh-nodejs14-nodejs-nodemon (Red Hat package)
npm
nodejs8-docs
npm8
nodejs8-devel
nodejs8-debugsource
nodejs8-debuginfo
nodejs8
nodejs12-docs
npm12
nodejs12-devel
nodejs12-debugsource
nodejs12-debuginfo
nodejs12
nodejs14
nodejs14-debuginfo
nodejs14-debugsource
nodejs14-devel
npm14
nodejs14-docs
corepack14
nodejs
nodejs-devel
nodejs-full-i18n
nodejs-docs
rh-nodejs14-nodejs (Red Hat package)
nodejs-packaging
IBM App Connect Enterprise
SINEC INS
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM InfoSphere Information Server

Install updates from vendor's website.

node-fetch - update to 3.1.1
Migration Toolkit for Containers - update to 1.7.2
Cloud Pak for Security (CP4S) - update to 1.10.15.0
IBM Cloud Transformation Advisor - update to 3.1.0
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.8, 2.3.10, 2.3.11, 2.4.3, 2.4.4, 2.5.0
IBM Cloud Automation Manager - update to 4.2.0.1 iFix 6
IBM Intelligent Operations Center - update to 5.2.4
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.1
IBM Business Automation Manager Open Editions - update to 8.0.1
JBoss Data Grid - update to 8.4.0
IBM App Connect Enterprise - update to 11.0.0.16
node-fetch (Ubuntu package) - addressed in versions Ubuntu Pro, 1.7.3-2ubuntu0.1
SINEC INS - update to 1.0 SP2
Cognos Analytics Mobile (Android) - update to 1.1.20
Cognos Analytics Mobile (iOS) - update to 1.1.20
nodejs-nodemon - update to 2.0.20-2
rh-nodejs14-nodejs-nodemon (Red Hat package) - update to 2.0.20-2.el7
IBM Planning Analytics Workspace - update to 2.0.94
Red Hat Integration - Service Registry - update to 2.3.0
IBM QRadar Data Synchronization App - update to 3.1.1
QRadar Assistant - update to 3.6.0
Red Hat OpenShift Container Platform - update to 4.11.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.11.0
npm - update to 6.14.17-1.14.21.1.2.0.1
nodejs8-docs - update to 8.17.0-150200.10.22.1
npm8 - update to 8.17.0-150200.10.22.1
nodejs8-devel - update to 8.17.0-150200.10.22.1
nodejs8-debugsource - update to 8.17.0-150200.10.22.1
nodejs8-debuginfo - update to 8.17.0-150200.10.22.1
nodejs8 - update to 8.17.0-150200.10.22.1
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
nodejs12-docs - addressed in versions 12.22.12-1.48.1, 12.22.12-150200.4.32.1
npm12 - addressed in versions 12.22.12-1.48.1, 12.22.12-150200.4.32.1
nodejs12-devel - addressed in versions 12.22.12-1.48.1, 12.22.12-150200.4.32.1
nodejs12-debugsource - addressed in versions 12.22.12-1.48.1, 12.22.12-150200.4.32.1
nodejs12-debuginfo - addressed in versions 12.22.12-1.48.1, 12.22.12-150200.4.32.1
nodejs12 - addressed in versions 12.22.12-1.48.1, 12.22.12-150200.4.32.1
nodejs14 - addressed in versions 14.19.1-6.28.1, 14.19.1-150200.15.31.1
nodejs14-debuginfo - addressed in versions 14.19.1-6.28.1, 14.19.1-150200.15.31.1
nodejs14-debugsource - addressed in versions 14.19.1-6.28.1, 14.19.1-150200.15.31.1
nodejs14-devel - addressed in versions 14.19.1-6.28.1, 14.19.1-150200.15.31.1
npm14 - addressed in versions 14.19.1-6.28.1, 14.19.1-150200.15.31.1
nodejs14-docs - addressed in versions 14.19.1-6.28.1, 14.19.1-150200.15.31.1
corepack14 - update to 14.19.1-150200.15.31.1
nodejs - update to 14.21.1-2.0.1
nodejs-devel - update to 14.21.1-2.0.1
nodejs-full-i18n - update to 14.21.1-2.0.1
nodejs-docs - update to 14.21.1-2.0.1
rh-nodejs14-nodejs (Red Hat package) - update to 14.21.1-3.el7
nodejs-packaging - update to 23-3

• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10

• Information disclosure in node-fetch
• Information disclosure in IBM Cloud Automation Manager
• Information disclosure in IBM App Connect Enterprise
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.3
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Integration - Service registry
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in Red Hat Data Grid
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Multiple vulnerabilities in Oracle Linux
• Red Hat Software Collections update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon
• Multiple vulnerabilities in IBM QRadar Data Synchronization
• Red Hat Enterprise Linux 8.6 Extended Update Support update for the nodejs:14 module
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Engineering Requirements Quality Assistant On-Premises
• Ubuntu update for node-fetch
• Multiple vulnerabilities in IBM Intelligent Operations Center
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Planning Analytics
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android)
• Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS)
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2
• SUSE update for nodejs14
• SUSE update for nodejs12
• SUSE update for nodejs14
• SUSE update for nodejs12
• SUSE update for nodejs8
• Anolis OS update for nodejs:14 module
• Multiple vulnerabilities in IBM QRadar Assistant