[GHSA-48rx-c7pg-q66r] Excon does not redact additional sensitive/risky headers when following redirects

[Amayyas]

Updates

• CWEs

Comments
This advisory currently has no CWE assigned. The vulnerability class here —
sensitive HTTP headers being forwarded across an origin boundary when
following a redirect — is consistently classified as CWE-200: Exposure of
Sensitive Information to an Unauthorized Actor across other GitHub advisories
for the exact same pattern:

• aiohttp, Cookie/Proxy-Authorization leak on redirect: GHSA-966j-vmvw-g2g9 (CWE-200)
• Twisted, Cookie/Authorization leak on redirect: GHSA-92x2-jw7w-xvvx (CWE-200)
• Angular Service Worker, header leak on cross-origin redirect: GHSA-qxh6-94w6-9r5p (CWE-200)
• Microsoft Kiota, Cookie/Proxy-Authorization leak on redirect: GHSA-7j59-v9qr-6fq9 (CWE-200)

This advisory describes the same underlying weakness for excon's
RedirectFollower middleware, which previously failed to strip additional
sensitive headers before following a redirect to a new target. Adding CWE-200
aligns this entry with how GitHub already classifies this well-established
vulnerability pattern.

References:

• Fix commit: excon/excon@ea89a35
• Precedent (same pattern, CWE-200): GHSA-966j-vmvw-g2g9
• Precedent (same pattern, CWE-200): GHSA-92x2-jw7w-xvvx

[github]

Hi there @geemus! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[geemus]

Sounds reasonable, thanks.