Bug 2248979 (CVE-2023-45857)
| Summary: | CVE-2023-45857 axios: exposure of confidential data stored in cookies | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Robb Gatica <rgatica> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | CLOSED COMPLETED | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aarif, aazores, adudiak, aileenc, amasferr, aprice, bdettelb, caswilli, chazlett, cmiranda, davidn, dfreiber, dhalasz, dhanak, dkenigsb, dkuc, dsimansk, dymurray, eaguilar, ebaron, ecerquei, epacific, eric.wittmann, fdeutsch, fjansen, gmalinko, gparvin, hkataria, ibek, ibolton, janstey, jburrell, jcammara, jcantril, jchui, jhardy, jkang, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jobarker, jpallich, jrokos, jsamir, jshaughn, jsherril, jtanner, jwendell, kaycoth, kingland, kshier, ktsao, kverlaen, lbainbri, mabashia, matzew, michel, mkholjur, mkudlej, mnovotny, mpierce, mwringe, nboldt, njean, nobody+337840, oezr, omaciel, orabin, oramraz, osapryki, owatkins, pahickey, pantinor, parichar, pcongius, pdelbell, periklis, pierdipi, pjindal, porcelli, psegedy, rcernich, rguimara, rhaigner, rhuss, rjohnson, rogbas, rtaniwa, sdawley, sfroberg, simaishi, sipoyare, skontopo, slucidi, smcdonal, smullick, sseago, stcannon, sthirugn, tasato, teagle, tfister, tjochec, tkral, twalsh, vkrizan, vkumar, vmugicag, yguenane, zsadeh |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | axios 1.6.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Axios that may expose a confidential session token. This issue can allow a remote attacker to bypass security measures and view sensitive data.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-03-27 08:57:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2266571, 2266568, 2266570, 2266572, 2266573, 2266574, 2266575, 2266576, 2266577, 2267101 | ||
| Bug Blocks: | 2248978 | ||
|
Description
Robb Gatica
2023-11-09 23:49:56 UTC
Created ansible-collection-awx-awx tracking bugs for this issue: Affects: epel-all [bug 2266571] Affects: fedora-all [bug 2266572] Created cachelib tracking bugs for this issue: Affects: fedora-all [bug 2266573] Created fbthrift tracking bugs for this issue: Affects: fedora-all [bug 2266574] Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2266575] Created pgadmin4 tracking bugs for this issue: Affects: fedora-all [bug 2266576] Created rstudio tracking bugs for this issue: Affects: fedora-all [bug 2266577] Is there a way to opt out of these for some packages? I keep getting false positives on website files that are never shipped as part of the binary RPMs see https://src.fedoraproject.org/rpms/cachelib/blob/rawhide/f/cachelib.spec https://src.fedoraproject.org/rpms/fbthrift/blob/rawhide/f/fbthrift.spec This issue has been addressed in the following products: Red Hat Ansible Automation Platform 2.4 for RHEL 9 Red Hat Ansible Automation Platform 2.4 for RHEL 8 Via RHSA-2024:1640 https://access.redhat.com/errata/RHSA-2024:1640 This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.8 Via RHSA-2024:1925 https://access.redhat.com/errata/RHSA-2024:1925 This issue has been addressed in the following products: RHEL-9-CNV-4.15 Via RHSA-2024:3314 https://access.redhat.com/errata/RHSA-2024:3314 This issue has been addressed in the following products: MTA-7.0-RHEL-9 MTA-7.0-RHEL-8 Via RHSA-2024:3316 https://access.redhat.com/errata/RHSA-2024:3316 This issue has been addressed in the following products: RHEL-9-CNV-4.14 Via RHSA-2024:3473 https://access.redhat.com/errata/RHSA-2024:3473 This issue has been addressed in the following products: MTA-6.2-RHEL-9 MTA-6.2-RHEL-8 Via RHSA-2024:3989 https://access.redhat.com/errata/RHSA-2024:3989 This issue has been addressed in the following products: RHEL-8-CNV-4.12 Via RHSA-2024:4269 https://access.redhat.com/errata/RHSA-2024:4269 This issue has been addressed in the following products: RHEL-9-CNV-4.16 Via RHSA-2024:4455 https://access.redhat.com/errata/RHSA-2024:4455 This issue has been addressed in the following products: RHEL-9-CNV-4.13 Via RHSA-2024:5314 https://access.redhat.com/errata/RHSA-2024:5314 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.7 Via RHSA-2025:2876 https://access.redhat.com/errata/RHSA-2025:2876 |