CVE-2023-28155

NameCVE-2023-28155
DescriptionThe Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1033250

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
node-request (PTS)bullseye2.88.1-5vulnerable
bookworm2.88.1-6vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
node-requestsource(unstable)(unfixed)1033250

Notes

[bookworm] - node-request <ignored> (Minor issue)
[bullseye] - node-request <no-dsa> (Minor issue)
[buster] - node-request <no-dsa> (Minor issue)
https://github.com/request/request/issues/3442
Search for package or bug name: Reporting problems