Vulnerabilities

 2 via 2 paths

Dependencies

 9

Source

 npm
Find a vulnerability free version of docker-modem | View docker-modem package health on Snyk Advisor

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

medium severity

Information Exposure

  • Vulnerable module: follow-redirects
  • Introduced through: follow-redirects@0.0.3

Detailed paths

  • Introduced through: docker-modem@0.1.23 › follow-redirects@0.0.3
    Remediation: Upgrade to docker-modem@0.3.2.

Overview

Affected versions of this package are vulnerable to Information Exposure by leaking the cookie header to a third party site in the process of fetching a remote URL with the cookie in the request body. If the response contains a location header, it will follow the redirect to another URL of a potentially malicious actor, to which the cookie would be exposed.

Remediation

Upgrade follow-redirects to version 1.14.7 or higher.

References

Information Exposure vulnerability report

low severity

Information Exposure

  • Vulnerable module: follow-redirects
  • Introduced through: follow-redirects@0.0.3

Detailed paths

  • Introduced through: docker-modem@0.1.23 › follow-redirects@0.0.3
    Remediation: Upgrade to docker-modem@0.3.2.

Overview

Affected versions of this package are vulnerable to Information Exposure due a leakage of the Authorization header from the same hostname during HTTPS to HTTP redirection. An attacker who can listen in on the wire (or perform a MITM attack) will be able to receive the Authorization header due to the usage of the insecure HTTP protocol which does not verify the hostname the request is sending to.

Remediation

Upgrade follow-redirects to version 1.14.8 or higher.

References

Information Exposure vulnerability report