Update dependency axios to v0.21.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
axios (source)	0.21.1 → 0.21.2

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Axios vulnerable to Server-Side Request Forgery

CVE-2020-28168 / GHSA-4w2v-q235-vp99

More information

Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-28168
• https://github.com/axios/axios/issues/3369
• https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55
• https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
• https://www.npmjs.com/package/axios
• https://www.npmjs.com/advisories/1594
• https://lists.apache.org/thread.html/r954d80fd18e9dafef6e813963eb7e08c228151c2b6268ecd63b35d1f@%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r25d53acd06f29244b8a103781b0339c5e7efee9099a4d52f0c230e4a@%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rdfd2901b8b697a3f6e2c9c6ecc688fd90d7f881937affb5144d61d6e@%3Ccommits.druid.apache.org%3E
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-4w2v-q235-vp99

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

axios Inefficient Regular Expression Complexity vulnerability

CVE-2021-3749 / GHSA-cph5-m8f7-6c5x

More information

Details

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3749
• https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
• https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
• https://www.npmjs.com/package/axios
• https://lists.apache.org/thread.html/r075d464dce95cd13c03ff9384658edcccd5ab2983b82bfc72b62bb10@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r216f0fd0a3833856d6a6a1fada488cadba45f447d87010024328ccf2@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r3ae6d2654f92c5851bdb73b35e96b0e4e3da39f28ac7a1b15ae3aab8@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r4bf1b32983f50be00f9752214c1b53738b621be1c2b0dbd68c7f2391@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r7324ecc35b8027a51cb6ed629490fcd3b2d7cf01c424746ed5744bf1@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/r74d0b359408fff31f87445261f0ee13bdfcac7d66f6b8e846face321@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/ra15d63c54dc6474b29f72ae4324bcb03038758545b3ab800845de7a1@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rc263bfc5b53afcb7e849605478d73f5556eb0c00d1f912084e407289@​%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/rfa094029c959da0f7c8cd7dc9c4e59d21b03457bf0cedf6c93e1bb0a@%3Cdev.druid.apache.org%3E
• https://lists.apache.org/thread.html/rfc5c478053ff808671aef170f3d9fc9d05cc1fab8fb64431edc66103@​%3Ccommits.druid.apache.org%3E
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
• https://github.com/advisories/GHSA-cph5-m8f7-6c5x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

axios/axios (axios)

v0.21.2

Compare Source

Fixes and Functionality:

• Updating axios requests to be delayed by pre-emptive promise creation (#​2702)
• Adding "synchronous" and "runWhen" options to interceptors api (#​2702)
• Updating of transformResponse (#​3377)
• Adding ability to omit User-Agent header (#​3703)
• Adding multiple JSON improvements (#​3688, #​3763)
• Fixing quadratic runtime and extra memory usage when setting a maxContentLength (#​3738)
• Adding parseInt to config.timeout (#​3781)
• Adding custom return type support to interceptor (#​3783)
• Adding security fix for ReDoS vulnerability (#​3980)

Internal and Tests:

• Updating build dev dependancies (#​3401)
• Fixing builds running on Travis CI (#​3538)
• Updating follow rediect version (#​3694, #​3771)
• Updating karma sauce launcher to fix failing sauce tests (#​3712, #​3717)
• Updating content-type header for application/json to not contain charset field, according do RFC 8259 (#​2154)
• Fixing tests by bumping karma-sauce-launcher version (#​3813)
• Changing testing process from Travis CI to GitHub Actions (#​3938)

Documentation:

• Updating documentation around the use of AUTH_TOKEN with multiple domain endpoints (#​3539)
• Remove duplication of item in changelog (#​3523)
• Fixing gramatical errors (#​2642)
• Fixing spelling error (#​3567)
• Moving gitpod metion (#​2637)
• Adding new axios documentation website link (#​3681, #​3707)
• Updating documentation around dispatching requests (#​3772)
• Adding documentation for the type guard isAxiosError (#​3767)
• Adding explanation of cancel token (#​3803)
• Updating CI status badge (#​3953)
• Fixing errors with JSON documentation (#​3936)
• Fixing README typo under Request Config (#​3825)
• Adding axios-multi-api to the ecosystem file (#​3817)
• Adding SECURITY.md to properly disclose security vulnerabilities (#​3981)

Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:

• Sasha Korotkov
• Daniel Lopretto
• Mike Bishop
• Dmitriy Mozgovoy
• Mark
• Philipe Gouveia Paixão
• hippo
• ready-research
• Xianming Zhong
• Christopher Chrapka
• Brian Anglin
• Kohta Ito
• Ali Clark
• caikan
• Elina Gorshkova
• Ryota Ikezawa
• Nisar Hassan Naqvi
• Jake
• TagawaHirotaka
• Johannes Jarbratt
• Mo Sattler
• Sam Carlton
• Matt Czapliński
• Ziding Zhang

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.