REDHAT-BUG-2467927: High severity Axios axios vulnerability
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.15.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2467927?
The severity of REDHAT-BUG-2467927 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2467927?
To fix REDHAT-BUG-2467927, update Axios to version 1.15.2 or later.
What are the affected software versions for REDHAT-BUG-2467927?
Versions of Axios from 1.0.0 to before 1.15.2 are affected by REDHAT-BUG-2467927.
What vulnerabilities does REDHAT-BUG-2467927 introduce?
REDHAT-BUG-2467927 introduces potential security issues through improper property access without protection.
Is there a workaround for REDHAT-BUG-2467927?
The recommended approach for REDHAT-BUG-2467927 is to upgrade to the latest version, as there are no official workarounds noted.