Fix CVE–2022–0355

[debricked]

CVE–2022–0355

Vulnerable dependency:     simple-get (Yarn)    3.1.1

Vulnerability details

Description

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

NVD

Exposure of Sensitive Information to an Unauthorized Actor in NPM simple-get prior to 4.0.1.

GitHub

Exposure of Sensitive Information in simple-get

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.

CVSS details - 7.5

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	None
Availability	None

References

    Bug fix: thirdparty site cookie leak by ranjit-git · Pull Request #72 · feross/simple-get · GitHub
    Backport security fix for 4.0.1 to 2.x.x by erlend-oftedal-adsk · Pull Request #75 · feross/simple-get · GitHub
    Comparing feross:HEAD...ranjit-git:master · feross/simple-get · GitHub
    simple-get/index.js at master · feross/simple-get · GitHub
    Backport security fix for 4.0.1 to 3.x.x by eoftedal · Pull Request #76 · feross/simple-get · GitHub
    GitHub - feross/simple-get: Simplest way to make http get requests. Supports HTTPS, redirects, gzip/deflate, streams in < 100 lines
    Merge pull request #73 from ranjit-git/master · feross/simple-get@e4af095 · GitHub
    simple-get/index.js at master · feross/simple-get · GitHub
    Exposure of Sensitive Information in simple-get · CVE-2022-0355 · GitHub Advisory Database · GitHub
    Exposure of Sensitive Information to an Unauthorized Actor vulnerability found in simple-get
    Bug fix: thirdparty site cookie leak by ranjit-git · Pull Request #73 · feross/simple-get · GitHub
    NVD - CVE-2022-0355
    simple-get/index.js at master · feross/simple-get · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

[anatolyza]

this pr is rolling back version of deps that were just rolled forward due to CVEs