CVE-2020-11021
1 advisory.
npm/@actions/http-client CVE-2020-11021: medium 6.3
Http request which redirect to another hostname do not strip authorization header in @actions/http-client
Action: Upgrade @actions/http-client to 1.0.8 or later.
npm i @actions/http-client@1.0.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.8 | - |
Fixed versions
| 1.0.8 |
Sources
- osv: GHSA-9w6v-m7wp-jwg4
- https://github.com/actions/http-client/security/advisories/GHSA-9w6v-m7wp-jwg4
- https://nvd.nist.gov/vuln/detail/CVE-2020-11021
- https://github.com/actions/http-client/pull/27
- https://github.com/actions/http-client/commit/f6aae3dda4f4c9dc0b49737b36007330f78fd53a
- https://github.com/actions/http-client
CVE-2020-11021 · published · modified · JSON