Information disclosure in follow-redirects - CVE-2024-28849

Vulnerability identifier: #VU87551

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-28849

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to credentials are shared via headers when following cross-domain redirects. A remote attacker can gain access to sensitive information.

follow-redirects
watsonx.data
IBM Business Automation Workflow
Use Case Manager App
IBM Process Mining
OpenShift Logging
Oracle Blockchain Platform
Oracle Communications Network Analytics Data Director
Migration Toolkit for Runtimes
IBM Fusion HCI
Unified OSS Console Assurance Monitoring (UOCAM)
QRadar User Behavior Analytics
Red Hat Advanced Cluster Security for Kubernetes
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation
IBM Automation Decision Services
Software Support App (iOS)
Software Support app (Android)
Storage Defender - Resiliency Service
Cloud Pak for Network Automation
Rational Developer for i
IBM Security Verify Information Queue
IBM i Modernization Engine for Lifecycle Integration
QRadar Pre-Validation App
QRadar Deployment Intelligence App
QRadar Assistant
Security QRadar EDR
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
QRadar Log Source Management App
Db2 Big SQL
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Storage Protect Plus Server
Robotic Process Automation for Cloud Pak
Business Automation Insights
OpenShift Service Mesh
Communications Unified Assurance
Voice Gateway
PeopleSoft Enterprise PeopleTools
IBM API Connect
IBM Cognos Controller
Event Streams
Ubuntu
Fedora
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
automation-eda-controller (Red Hat package)
ansible-rulebook (Red Hat package)
node-follow-redirects (Ubuntu package)
receptor (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
ansible-core (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python3x-aiohttp (Red Hat package)
python-aiohttp (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
automation-controller (Red Hat package)
python3x-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
pgadmin4
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
Network Observability plugin for the Openshift Console
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
QRadar Suite
IBM Security QRadar Analyst Workflow
Red Hat OpenShift GitOps
IBM Cloud Pak System
IBM DB2
IBM App Connect Enterprise

Install updates from vendor's website.

follow-redirects - update to 1.15.6
Software Support App (iOS) - update to 2.0.0
Software Support app (Android) - update to 2.0.0
Use Case Manager App - update to 3.10.0
IBM Process Mining - update to 1.15.0
Storage Defender - Resiliency Service - update to 2.0.3
OpenShift Service Mesh - update to 2.5.1
Cloud Pak for Network Automation - update to 2.7.4
Rational Developer for i - update to 9.8.0.2
IBM Security Verify Information Queue - update to 10.0.9
IBM API Connect - update to 10.0.8.5
IBM Cognos Controller - update to 11.0.1.0.3
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - update to 0.5.0-1.el9ap
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
Voice Gateway - addressed in versions 1.0.8.11, 1.0.8.19
node-follow-redirects (Ubuntu package) - addressed in versions 1.2.4-1ubuntu0.18.04.1~esm1, 1.2.4-1ubuntu0.20.04.1~esm1, 1.14.9+~1.14.1-1ubuntu0.1~esm1
Migration Toolkit for Runtimes - update to 1.2.6
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.7
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
Network Observability plugin for the Openshift Console - update to 1.6.0
Migration Toolkit for Containers - update to 1.8.4
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
QRadar Suite - update to 1.10.22.0
Red Hat OpenShift GitOps - update to 1.12.6
QRadar Pre-Validation App - update to 2.0.1
watsonx.data - update to 2.0.3
IBM Cloud Pak System - update to 2.3.4.0
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
IBM Fusion HCI - update to 2.9.0
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap
IBM Security QRadar Analyst Workflow - update to 2.32.1
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - update to 2.32.2-1.el9ap
QRadar Deployment Intelligence App - update to 3.0.14
Unified OSS Console Assurance Monitoring (UOCAM) - update to 3.1.4
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 (Red Hat package) - update to 3.1.4-1.el9ap
QRadar Assistant - update to 3.7.0
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
python-aiohttp (Red Hat package) - update to 3.9.5-1.el9ap
Security QRadar EDR - update to 3.12.8
python3x-pulpcore (Red Hat package) - update to 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - update to 3.28.27-1.el9ap
QRadar User Behavior Analytics - update to 4.1.16
Red Hat Advanced Cluster Security for Kubernetes - update to 4.5.0
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.8
DB2 on Cloud Pak for Data - update to 4.8.8
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
Red Hat OpenShift Container Platform - update to 4.16.0
IBM DB2 - update to 5.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.1
App Connect Enterprise Certified Container - addressed in versions 5.0.17, 11.5.0
Cognos Dashboards on Cloud Pak for Data - update to 5.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3
QRadar Log Source Management App - update to 7.0.9
Db2 Big SQL - update to 7.6.4
pgadmin4 - update to 8.4-2.fc40
Maximo Application Suite - Monitor Component - addressed in versions 8.10.10, 8.11.7
IBM Maximo Application Suite - addressed in versions 8.10.12, 8.11.10
Maximo Application Suite - Edge Data Collector - update to 8.11.7
Storage Protect Plus Server - update to 10.1.16.2
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
IBM App Connect Enterprise - addressed in versions 11.0.0.26, 12.0.12.0
Event Streams - update to 11.4.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.32, 23.0.2.4
IBM Robotic Process Automation - addressed in versions 21.0.7.15, 23.0.16
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.15, 23.0.16
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-gunicorn (Red Hat package) - update to 22.0.0-1.el9ap
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
Business Automation Insights - update to 23.0.2.0.4
IBM Automation Decision Services - update to 23.0.2.0.5
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el9ap
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - update to 42.0.5-1.el9ap

• https://github.com/follow-redirects/follow-redirects/commit/c4f847f85176991f95ab9c88af63b1294de8649b
• https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
• https://github.com/psf/requests/issues/1885
• https://hackerone.com/reports/2390009
• https://bugzilla.redhat.com/show_bug.cgi?id=2269576

• Information disclosure in follow-redirects
• Fedora 40 update for pgadmin4
• Multiple vulnerabilities in Logging Subsystem 5.8 for Red Hat OpenShift for RHEL 9
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Analyst Workflow
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh Containers 2.5
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM QRadar Assistant
• Information disclosure in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Voice Gateway
• Information disclosure in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM QRadar Log Source Management App
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM Business Automation Workflow traditional
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.6
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Automation Decision Services
• Information disclosure in IBM Process Mining
• Information disclosure in IBM Rational Developer for i
• Information disclosure in IBM Maximo Application Suite
• Information disclosure in IBM Event Streams
• Information disclosure in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5.0
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Information disclosure in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Multiple vulnerabilities in IBM Security QRadar EDR
• Information disclosure in IBM Robotic Process Automation
• Information disclosure in IBM Edge Data Collector
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in Storage Protect Plus Server
• Information disclosure in IBM Watson Discovery for IBM Cloud Pak for Data
• Multiple vulnerabilities in Use Case Manager App
• IBM watsonx.data update for Node.js
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Oracle Blockchain Platform
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in IBM QRadar Pre-Validation App
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Fusion
• IBM Big SQL on Cloud Pak for Data update for Node.js follow-redirects
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Software Support app
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in HPE Unified OSS Console Assurance Monitoring (UOCAM)
• Multiple vulnerabilities in IBM API Connect
• Ubuntu update for node-follow-redirects
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 7.0