Homepage

@actions/http-client/.../http-client@1.0.5 vulnerabilities

Actions Http Client

  • latest version

    2.2.3

  • latest non vulnerable version

    2.2.3

  • first published

    4 years ago

  • latest version published

    3 months ago

  • licenses detected

  • View http-client package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @actions/http-client package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Information Disclosure

    @actions/http-client is an actions-http-client.

    Affected versions of this package are vulnerable to Information Disclosure. Actions Http-Client can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client:

    1. make an http request with an authorization header
    2. that request leads to a redirect (302) and
    3. the redirect url redirects to another domain or hostname

    Then the authorization header will get passed to the other domain.

    How to fix Information Disclosure?

    Upgrade @actions/http-client to version 1.0.8 or higher.

    <1.0.8
    Go back to all versions of this package