Bug 2057442 (CVE-2022-0639)
| Summary: | CVE-2022-0639 npm-url-parse: Authorization Bypass Through User-Controlled Key | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aos-bugs, bdettelb, caswilli, dwhatley, dymurray, gparvin, ibolton, jkoehler, jmatthew, jmontleo, jramanat, jwendell, kaycoth, michal.skrivanek, mperina, njean, ovanders, pahickey, rcernich, rfreiman, slucidi, sseago, stcannon, twalsh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
An authorization bypass flaw was found in url-parse. This flaw allows a local unauthenticated attacker to add an at symbol (@) while submitting a URL. This issue enables the bypass of validation or block-listing restrictions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-25 14:55:07 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2060935, 2060936, 2110609, 2110610, 2110856 | ||
| Bug Blocks: | 2057443 | ||
|
Description
Pedro Sampaio
2022-02-23 12:05:35 UTC
services affected per following: services-ccx/advisor-frontend:a764354/url-parse-1.5.1 https://github.com/RedHatInsights/ocp-advisor-frontend/blob/prod-stable/package-lock.json services-management-platform/frontend-starter-app/frontend-starter-app:2b2ef7d/url-parse-1.5.1 https://github.com/RedHatInsights/sed-frontend/blob/master/package-lock.json services-rhods/rhods/jupyterhub-odh:64e363a/url-parse-1.4.7 https://github.com/red-hat-data-services/jupyterhub-odh/blob/master/package-lock.json services-rhcert/rhcert-spa:c8824a1/url-parse-1.5.3 https://gitlab.cee.redhat.com/certification/rhcert-spa/blob/master/package-lock.json services-rhcert/rhcert-spa:c8824a1/url-parse-1.5.3 https://gitlab.cee.redhat.com/certification/rhcert-spa/blob/master/yarn.lock services-assisted-installer/facet:11c368f/url-parse-1.5.3 https://github.com/openshift-assisted/assisted-ui/blob/master/yarn.lock This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.7 Via RHSA-2022:6429 https://access.redhat.com/errata/RHSA-2022:6429 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0639 |