Your message dated Sat, 26 Mar 2022 11:59:13 +0000
with message-id
<c4d20274f6d76a43fb574d2177f6e3af4235e4be.ca...@adam-barratt.org.uk>
and subject line Closing p-u requests for updates in 11.3
has caused the Debian Bug report #1004033,
regarding bullseye-pu: package node-fetch/2.6.1-5+deb11u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1004033: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004033
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian....@packages.debian.org
Usertags: pu
[ Reason ]
node-fetch is vulnerable to privacy breach (CVE-2022-0235)
[ Impact ]
Medium vulnerability
[ Tests ]
Test passed
[ Risks ]
Low risk, patch just cleans headers
[ Checklist ]
[X] *all* changes are documented in the d/changelog
[X] I reviewed all changes and I approve them
[X] attach debdiff against the package in (old)stable
[X] the issue is verified as fixed in unstable
[ Changes ]
Clean headers before request
Cheers,
Yadd
diff --git a/debian/changelog b/debian/changelog
index 7f3da38..31eb312 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+node-fetch (2.6.1-5+deb11u1) bullseye; urgency=medium
+
+ * Team upload
+ * Don't forward secure headers to 3th party (Closes: CVE-2022-0235)
+
+ -- Yadd <y...@debian.org> Wed, 19 Jan 2022 16:46:28 +0100
+
node-fetch (2.6.1-5) unstable; urgency=medium
* Team upload
diff --git a/debian/patches/CVE-2022-0235.patch
b/debian/patches/CVE-2022-0235.patch
new file mode 100644
index 0000000..d97cd7a
--- /dev/null
+++ b/debian/patches/CVE-2022-0235.patch
@@ -0,0 +1,22 @@
+Description: don't forward secure headers to 3th party
+Author: Jimmy Wärting <ji...@warting.se>
+Origin: upstream, https://github.com/node-fetch/node-fetch/commit/f5d3cf5e
+Bug: https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/
+Forwarded: not-needed
+Reviewed-By: Yadd <y...@debian.org>
+Last-Update: 2022-01-19
+
+--- a/src/index.js
++++ b/src/index.js
+@@ -170,6 +170,11 @@
+ requestOpts.body =
undefined;
+
requestOpts.headers.delete('content-length');
+ }
++ if (!isDomainOrSubdomain(request.url, locationURL)) {
++ for (const name of
['authorization', 'www-authenticate', 'cookie', 'cookie2']) {
++
requestOptions.headers.delete(name);
++ }
++ }
+
+ // HTTP-redirect fetch step 15
+ resolve(fetch(new
Request(locationURL, requestOpts)));
diff --git a/debian/patches/series b/debian/patches/series
index 882f8ed..20c4319 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
babelrc.patch
fix-default-export.diff
drop-legacy-rollup-babel-plugin.patch
+CVE-2022-0235.patch
--- End Message ---
--- Begin Message ---
Package: release.debian.org
Version: 11.3
Hi,
The updates referenced by these bugs were included in stable as part of
this morning's 11.3 point release.
Regards,
Adam
--- End Message ---
