Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2022-0235 · Microsoft / collected KEV context

EUVD-2022-0683

GHSA-r683-j2x4-v87g

cve-program · CVE-2022-0235

• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html

euvd · EUVD-2022-0683

• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html

nvd · CVE-2022-0235

• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html

osv · GHSA-r683-j2x4-v87g

• https://nvd.nist.gov/vuln/detail/CVE-2022-0235
• https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
• https://github.com/node-fetch/node-fetch/pull/1453
• https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35
• https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10
• https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/node-fetch/node-fetch
• https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7
• https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html

No related operational record is retained in the current change model.