#1010924 bullseye-pu: package node-eventsource/1.0.7-1+deb11u1

Package:
release.debian.org
Source:
release.debian.org
Submitter:
Yadd
Date:
2022-07-09 10:52:22 UTC
Severity:
normal
Tags:
#1010924#5
Date:
2022-05-13 09:30:03 UTC
From:
To:
[ Reason ]
node-eventsource is vulnerable to sensible headers exposure
(CVE-2022-1650)

[ Impact ]
Medium vulnerability

[ Tests ]
Sadly tests are not launched in Bullseye. Tested locally, patch works

[ Risks ]
Low risk: patch is trivial

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
Drop Cookie/Authorization headers when following redirections

Cheers,
Yadd
#1010924#10
Date:
2022-05-28 19:07:59 UTC
From:
To:
Control: tags -1 + confirmed

FWIW, you mean sensitive. :-)

Please go ahead.

Regards,

Adam
#1010924#17
Date:
2022-05-29 18:18:49 UTC
From:
To:
package release.debian.org
tags 1010924 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-eventsource
Version: 1.0.7-1+deb11u1

Explanation: sttrip sensitive headers on redirect to different origin [CVE-2022-1650]
#1010924#22
Date:
2022-05-29 18:18:49 UTC
From:
To:
package release.debian.org
tags 1010924 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: node-eventsource
Version: 1.0.7-1+deb11u1

Explanation: sttrip sensitive headers on redirect to different origin [CVE-2022-1650]
#1010924#27
Date:
2022-07-09 10:47:43 UTC
From:
To:
(re-sending with fixed bug numbers)

Hi,

The updates discussed in these bugs were included in today's bullseye
point release.

Regards,

Adam