CVE-2024-39338
Fixed in a distro release EPSS 1%CVSS 4.0
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.7.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.0-r15 |
| Chainguard | airflow-2-compat | 2.11.0-r15 |
| Chainguard | airflow-2-iamguarded-compat | 2.11.0-r15 |
| Chainguard | argo-workflow-cli | 3.6.5-r2 |
| Chainguard | argo-workflow-controller | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-compat | 3.6.5-r2 |
| Chainguard | argo-workflow-executor | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-compat | 3.6.5-r2 |
| Chainguard | argo-workflows | 3.6.5-r2 |
| Chainguard | argo-workflows-known-hosts | 3.6.5-r2 |
| Chainguard | argo-workflows-ui | 3.6.5-r2 |
| Chainguard | jitsucom-jitsu | 2.8.0-r1 |
| Chainguard | jitsucom-jitsu-console | 2.8.0-r1 |
| Chainguard | jitsucom-jitsu-rotor | 2.8.0-r1 |
| Chainguard | kibana-7 | 7.17.24-r0 |
| Chainguard | kibana-7-bitnami | 7.17.24-r0 |
| Chainguard | kibana-8 | 8.17.3-r2 |
| Chainguard | kibana-8-bitnami | 8.17.3-r2 |
| Chainguard | kibana-8-iamguarded | 8.17.3-r2 |
| Chainguard | kubeflow-centraldashboard | 1.9.0-r1 |
| Chainguard | kubeflow-pipelines | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-apiserver | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-cache_server | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-frontend | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.2.0-r10 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r10 |
| Chainguard | lerna | 8.1.8-r1 |
| Debian 13 | node-axios | 1.7.4+dfsg-1 |
| Debian 14 | node-axios | 1.7.4+dfsg-1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | pgadmin4 | 8.5-150600.3.6.1 |
| Ubuntu 25.10 | node-axios | no fix |
| Ubuntu 26.10 | node-axios | no fix |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | argo-workflow-cli | 3.6.5-r2 |
| Wolfi | argo-workflow-controller | 3.6.5-r2 |
| Wolfi | argo-workflow-controller-compat | 3.6.5-r2 |
| Wolfi | argo-workflow-executor | 3.6.5-r2 |
| Wolfi | argo-workflow-executor-compat | 3.6.5-r2 |
| Wolfi | argo-workflows | 3.6.5-r2 |
| Wolfi | argo-workflows-known-hosts | 3.6.5-r2 |
| Wolfi | argo-workflows-ui | 3.6.5-r2 |
| Wolfi | jitsucom-jitsu | 2.8.0-r1 |
| Wolfi | jitsucom-jitsu-console | 2.8.0-r1 |
| Wolfi | jitsucom-jitsu-rotor | 2.8.0-r1 |
| Wolfi | kubeflow-centraldashboard | 1.9.0-r1 |
| Wolfi | kubeflow-pipelines | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-apiserver | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-cache_server | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-frontend | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.2.0-r10 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.2.0-r10 |
| Wolfi | lerna | 8.1.8-r1 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.6.1 |
| openSUSE Tumbleweed | velociraptor | 0.7.0.4.git97.675e45f9-12.1 |