[Pkg-javascript-devel] Bug#1094731: node-axios: CVE-2024-57965

[Salvatore Bonaccorso]

Source: node-axios
Version: 1.7.7+dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/axios/axios/issues/6351
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-axios.

CVE-2024-57965[0]:
| In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a
| URL object when determining an origin, and has a potentially
| unwanted setAttribute('href',href) call. NOTE: some parties feel
| that the code change only addresses a warning message from a SAST
| tool and does not fix a vulnerability.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-57965
    https://www.cve.org/CVERecord?id=CVE-2024-57965
[1] https://github.com/axios/axios/issues/6351
[2] https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db
[3] https://github.com/axios/axios/pull/6714

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore