open-source-dependency-vulnerabilitywidely-deployed-product-advisorycredential-access-method

Red Hat Updates Multiple Products for follow-redirects Proxy Credential Leak

Vulnerability Disclosure · 8 sources · Updated 2mo ago · First seen Jun 17, 2024

Red Hat released security updates for multiple products to remediate CVE-2024-28849 in the Node.js follow-redirects package. The flaw allows the Proxy-Authorization header to persist during a cross-domain redirect even when Authorization is removed, potentially exposing proxy-authentication credentials to the redirected destination. The issue is fixed in follow-redirects version 1.15.6; Red Hat states that upgrading is the only mitigation.

Affected advisories include Migration Toolkit for Applications 7.0.3 container images (RHSA-2024:3316), Network Observability 1.6.0 for Red Hat OpenShift (RHSA-2024:3868), and Red Hat Ansible Automation Platform 2.4 (RHSA-2024:3781). The updates also address additional bundled-component vulnerabilities, including denial-of-service, file-disclosure, certificate-validation, request-smuggling, and arbitrary-code-execution issues; organizations should apply the relevant updates across supported RHEL and OpenShift deployments.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Nov 17, 2023 – Jun 20, 2024

Reported Jun 27, 20242y ago
follow-redirects fixes cross-domain proxy credential leak
The follow-redirects project fixed CVE-2024-28849 in version 1.15.6. Vulnerable versions retained the Proxy-Authorization header during cross-domain redirects, potentially disclosing proxy-authentication credentials to the redirected destination; no workaround besides upgrading was identified.
2269576 - (CVE-2024-28849) CVE-2024-28849 follow-redirects: Possible credential leak
Jun 20, 20242y ago
Red Hat releases MTA 6.2.3 security update
Red Hat issued Important-rated RHSA-2024:3989 for Migration Toolkit for Applications 6.2.3 container images. The update remediated CVE-2024-28849 and vulnerabilities affecting Keycloak, webpack-dev-middleware, axios, css-tools, Vert.x, Apache Commons components, and Jetty.
RHSA-2024:3989 - Security Advisory - Red Hat Customer Portal
Jun 17, 20242y ago
Red Hat releases Network Observability 1.6.0 update
Red Hat issued Important-rated RHSA-2024:3868 for Network Observability 1.6.0 for OpenShift on RHEL 9. It addressed CVE-2024-28849 along with vulnerabilities in Go, golang-protobuf, webpack-dev-middleware, nodejs-ip, and Express.
RHSA-2024:3868 - Security Advisory - Red Hat Customer Portal
Jun 3, 20242y ago
Red Hat releases HawtIO 4.0.0 security update for Apache Camel 4
Red Hat issued Important-rated RHSA-2024:3550 for HawtIO 4.0.0 in Red Hat Build of Apache Camel 4 for x86_64. The update remediated CVE-2024-28849 and flaws in Spring Security, nodejs-ip, jose4j, and netty-codec-http.
RHSA-2024:3550 - Security Advisory - Red Hat Customer Portal
May 23, 20242y ago
Red Hat releases MTA 7.0.3 security update
Red Hat issued Important-rated RHSA-2024:3316 for Migration Toolkit for Applications 7.0.3 container images, including fixes for CVE-2024-28849 and multiple Go, axios, css-tools, webpack-dev-middleware, and golang-protobuf vulnerabilities.
RHSA-2024:3316 - Security Advisory - Red Hat Customer Portal
Mar 27, 20243y ago
Red Hat updates OpenShift Logging 5.8 for CVE-2024-28849
Red Hat issued Moderate-rated RHSA-2024:1474 for Logging for Red Hat OpenShift 5.8 on RHEL 9. The update remediated CVE-2024-28849 in follow-redirects and CVE-2024-24786, an infinite-loop denial-of-service flaw in golang-protobuf protojson.Unmarshal.
RHSA-2024:1474 - Security Advisory - Red Hat Customer Portal
Nov 17, 20233y ago
CSS-tools regular-expression DoS vulnerability reported
Patrick Del Bello reported CVE-2023-26364, an improper input-validation flaw in css-tools 4.3.0 and earlier. Crafted CSS can trigger regular-expression processing that causes a minor denial of service during CSS parsing; css-tools 4.3.1 fixes the issue.
2250364 - (CVE-2023-26364) CVE-2023-26364 css-tools: Improper Input Validation causes Denial of Service via Regular Expression
Reported Feb 15, 201116y ago
Red Hat updates Ansible Automation Platform 2.4
Red Hat released Moderate-rated RHSA-2024:3781 for Ansible Automation Platform 2.4 on RHEL 8 and 9. The update remediated 20 CVEs, including the follow-redirects credential-leak flaw CVE-2024-28849, and updated automation-controller, Automation Hub, ansible-core, and Receptor components.
RHSA-2024:3781 - Security Advisory - Red Hat Customer Portal

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

follow-redirects Proxy-Authorization Credential Leak (CVE-2024-28849)

Affected products

2 linked

Migration Toolkit For ApplicationsMigration Toolkit For Runtimes

Organizations

1 linked

Red Hat

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

8 references tracked. Mallory keeps watching after this page renders.

Redhat AccessNews · Jan 1, 2026

RHSA-2024:3989 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2024:3550 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2024:3868 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2024:3316 - Security Advisory - Red Hat Customer PortalOpen source ↗

Redhat AccessNews · Jan 1, 2026

RHSA-2024:1474 - Security Advisory - Red Hat Customer PortalOpen source ↗

Bugzilla RedhatNews · Jun 27, 2024

2269576 - (CVE-2024-28849) CVE-2024-28849 follow-redirects: Possible credential leakOpen source ↗

Bugzilla RedhatNews · May 23, 2024

2250364 - (CVE-2023-26364) CVE-2023-26364 css-tools: Improper Input Validation causes Denial of Service via Regular ExpressionOpen source ↗

Redhat AccessNews · Feb 15, 2011

RHSA-2024:3781 - Security Advisory - Red Hat Customer PortalOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

open-source-dependency-vulnerabilitywidely-deployed-product-advisorycredential-access-method

Red Hat Updates Multiple Products for follow-redirects Proxy Credential Leak

Vulnerability Disclosure · 8 sources · Updated 2mo ago · First seen Jun 17, 2024

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

8 events · Nov 17, 2023 – Jun 20, 2024

Reported Jun 27, 20242y ago
follow-redirects fixes cross-domain proxy credential leak
The follow-redirects project fixed CVE-2024-28849 in version 1.15.6. Vulnerable versions retained the Proxy-Authorization header during cross-domain redirects, potentially disclosing proxy-authentication credentials to the redirected destination; no workaround besides upgrading was identified.
2269576 - (CVE-2024-28849) CVE-2024-28849 follow-redirects: Possible credential leak
Jun 20, 20242y ago
Red Hat releases MTA 6.2.3 security update
Red Hat issued Important-rated RHSA-2024:3989 for Migration Toolkit for Applications 6.2.3 container images. The update remediated CVE-2024-28849 and vulnerabilities affecting Keycloak, webpack-dev-middleware, axios, css-tools, Vert.x, Apache Commons components, and Jetty.
RHSA-2024:3989 - Security Advisory - Red Hat Customer Portal
Jun 17, 20242y ago
Red Hat releases Network Observability 1.6.0 update
Red Hat issued Important-rated RHSA-2024:3868 for Network Observability 1.6.0 for OpenShift on RHEL 9. It addressed CVE-2024-28849 along with vulnerabilities in Go, golang-protobuf, webpack-dev-middleware, nodejs-ip, and Express.
RHSA-2024:3868 - Security Advisory - Red Hat Customer Portal
Jun 3, 20242y ago
Red Hat releases HawtIO 4.0.0 security update for Apache Camel 4
Red Hat issued Important-rated RHSA-2024:3550 for HawtIO 4.0.0 in Red Hat Build of Apache Camel 4 for x86_64. The update remediated CVE-2024-28849 and flaws in Spring Security, nodejs-ip, jose4j, and netty-codec-http.
RHSA-2024:3550 - Security Advisory - Red Hat Customer Portal
May 23, 20242y ago
Red Hat releases MTA 7.0.3 security update
Red Hat issued Important-rated RHSA-2024:3316 for Migration Toolkit for Applications 7.0.3 container images, including fixes for CVE-2024-28849 and multiple Go, axios, css-tools, webpack-dev-middleware, and golang-protobuf vulnerabilities.
RHSA-2024:3316 - Security Advisory - Red Hat Customer Portal
Mar 27, 20243y ago
Red Hat updates OpenShift Logging 5.8 for CVE-2024-28849
Red Hat issued Moderate-rated RHSA-2024:1474 for Logging for Red Hat OpenShift 5.8 on RHEL 9. The update remediated CVE-2024-28849 in follow-redirects and CVE-2024-24786, an infinite-loop denial-of-service flaw in golang-protobuf protojson.Unmarshal.
RHSA-2024:1474 - Security Advisory - Red Hat Customer Portal
Nov 17, 20233y ago
CSS-tools regular-expression DoS vulnerability reported
Patrick Del Bello reported CVE-2023-26364, an improper input-validation flaw in css-tools 4.3.0 and earlier. Crafted CSS can trigger regular-expression processing that causes a minor denial of service during CSS parsing; css-tools 4.3.1 fixes the issue.
2250364 - (CVE-2023-26364) CVE-2023-26364 css-tools: Improper Input Validation causes Denial of Service via Regular Expression
Reported Feb 15, 201116y ago
Red Hat updates Ansible Automation Platform 2.4
Red Hat released Moderate-rated RHSA-2024:3781 for Ansible Automation Platform 2.4 on RHEL 8 and 9. The update remediated 20 CVEs, including the follow-redirects credential-leak flaw CVE-2024-28849, and updated automation-controller, Automation Hub, ansible-core, and Receptor components.
RHSA-2024:3781 - Security Advisory - Red Hat Customer Portal

Linked entities