{"schemaVersion":3,"id":"CVE-2024-29041","aliases":["UBUNTU-CVE-2024-29041","DEBIAN-CVE-2024-29041","CGA-246g-68px-6v33","CGA-2p45-hw3w-26pc","CGA-56v2-q689-3hv9","CGA-5fpp-75wg-fmm4","CGA-622c-cc9v-q3vf","CGA-6742-8crj-wwr7","CGA-6hvp-g4jh-44ff","CGA-756v-hfwh-p9hp","CGA-84h8-pp2w-7fx9","CGA-c9p3-3w5r-65rw","CGA-c9ph-hj5p-43p3","CGA-cm4h-8xhh-p3gr","CGA-cwcg-g23v-f3px","CGA-f98j-9x78-6x7v","CGA-g83x-9p87-924g","CGA-gv53-x7hr-h8p4","CGA-hx79-rh8r-fgj4","CGA-mcjp-j8rf-rmxv","CGA-mcvj-8xhg-p4m5","CGA-mrv8-hrv6-vc5q","CGA-mwjf-vpj8-q3rj","CGA-pgp7-4h34-3mj2","CGA-qm4x-p2qv-c5wv","CGA-qq9w-h6c2-h25m","CGA-r6qr-m3xr-gvjj","CGA-rfw3-hjf4-x7jm","CGA-rgjh-r7x8-rvvm","CGA-rmmj-v9m9-cpp7","CGA-rvqg-82qv-w7m2","CGA-vhrc-r5jm-frgh","CGA-vpp6-665c-vffj","CGA-x9hf-6996-j9gm","GHSA-rv95-896h-c2vc","CGA-89rf-97cj-9p8w","CGA-92xx-3cm3-5634"],"status":"published","duplicateOf":null,"title":null,"description":"Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode [using `encodeurl`](https://github.com/pillarjs/encodeurl) on the contents before passing it to the `location` header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is `res.location()` but this is also called from within `res.redirect()`. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.","dates":{"published":"2024-03-25T20:20:06.205Z","modified":"2024-08-02T01:03:51.705Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":7.2,"impact":4.5,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00786,"percentile":0.55382,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00786},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00786,"percentile":0.55382}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00786,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00786,"percentile":0.55382}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site ('Open Redirect')","description":"The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Low","url":"https://cwe.mitre.org/data/definitions/601.html"},{"id":"CWE-1286","name":"Improper Validation of Syntactic Correctness of Input","description":"The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1286.html"}],"affected":[{"vendor":"chainguard","product":"arangodb-3.11","name":"arangodb-3.11","label":"arangodb-3.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/arangodb-3.11","purlType":"apk","versions":[{"text":"< 3.11.14.5-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.11.14.5-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"argo-workflows","name":"argo-workflows","label":"argo-workflows","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/argo-workflows","purlType":"apk","versions":[{"text":"< 3.6.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.5-r2","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"argo-workflows","label":"Argo Workflows","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.8.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines","name":"kubeflow-pipelines","label":"kubeflow-pipelines","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-apiserver","name":"kubeflow-pipelines-apiserver","label":"kubeflow-pipelines-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-apiserver","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-cache_server","name":"kubeflow-pipelines-cache_server","label":"kubeflow-pipelines-cache_server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-cache_server","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-cache-deployer","name":"kubeflow-pipelines-cache-deployer","label":"kubeflow-pipelines-cache-deployer","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-cache-deployer","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-cache-deployer-compat","name":"kubeflow-pipelines-cache-deployer-compat","label":"kubeflow-pipelines-cache-deployer-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-cache-deployer-compat","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-frontend","name":"kubeflow-pipelines-frontend","label":"kubeflow-pipelines-frontend","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-frontend","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-metadata-envoy-config","name":"kubeflow-pipelines-metadata-envoy-config","label":"kubeflow-pipelines-metadata-envoy-config","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-metadata-envoy-config","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-metadata-writer","name":"kubeflow-pipelines-metadata-writer","label":"kubeflow-pipelines-metadata-writer","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-metadata-writer","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-metadata-writer-compat","name":"kubeflow-pipelines-metadata-writer-compat","label":"kubeflow-pipelines-metadata-writer-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-metadata-writer-compat","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-persistence_agent","name":"kubeflow-pipelines-persistence_agent","label":"kubeflow-pipelines-persistence_agent","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-persistence_agent","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-scheduledworkflow","name":"kubeflow-pipelines-scheduledworkflow","label":"kubeflow-pipelines-scheduledworkflow","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-scheduledworkflow","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-viewer-crd-controller","name":"kubeflow-pipelines-viewer-crd-controller","label":"kubeflow-pipelines-viewer-crd-controller","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-viewer-crd-controller","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sqlpad","purlType":"apk","versions":[{"text":"< 7.4.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"sqlpad-compat","name":"sqlpad-compat","label":"sqlpad-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/sqlpad-compat","purlType":"apk","versions":[{"text":"< 7.4.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"argo-workflows","name":"argo-workflows","label":"argo-workflows","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/argo-workflows","purlType":"apk","versions":[{"text":"< 3.6.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.6.5-r2","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"argo-workflows","label":"Argo Workflows","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.8.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.8.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines","name":"kubeflow-pipelines","label":"kubeflow-pipelines","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-apiserver","name":"kubeflow-pipelines-apiserver","label":"kubeflow-pipelines-apiserver","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-apiserver","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-cache_server","name":"kubeflow-pipelines-cache_server","label":"kubeflow-pipelines-cache_server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-cache_server","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-cache-deployer","name":"kubeflow-pipelines-cache-deployer","label":"kubeflow-pipelines-cache-deployer","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-cache-deployer","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-cache-deployer-compat","name":"kubeflow-pipelines-cache-deployer-compat","label":"kubeflow-pipelines-cache-deployer-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-cache-deployer-compat","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-frontend","name":"kubeflow-pipelines-frontend","label":"kubeflow-pipelines-frontend","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-frontend","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-metadata-envoy-config","name":"kubeflow-pipelines-metadata-envoy-config","label":"kubeflow-pipelines-metadata-envoy-config","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-metadata-envoy-config","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-metadata-writer","name":"kubeflow-pipelines-metadata-writer","label":"kubeflow-pipelines-metadata-writer","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-metadata-writer","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-metadata-writer-compat","name":"kubeflow-pipelines-metadata-writer-compat","label":"kubeflow-pipelines-metadata-writer-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-metadata-writer-compat","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-persistence_agent","name":"kubeflow-pipelines-persistence_agent","label":"kubeflow-pipelines-persistence_agent","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-persistence_agent","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-scheduledworkflow","name":"kubeflow-pipelines-scheduledworkflow","label":"kubeflow-pipelines-scheduledworkflow","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-scheduledworkflow","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-viewer-crd-controller","name":"kubeflow-pipelines-viewer-crd-controller","label":"kubeflow-pipelines-viewer-crd-controller","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-viewer-crd-controller","purlType":"apk","versions":[{"text":"< 2.4.0-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.0-r9","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sqlpad","name":"sqlpad","label":"sqlpad","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sqlpad","purlType":"apk","versions":[{"text":"< 7.4.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4.1-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"sqlpad-compat","name":"sqlpad-compat","label":"sqlpad-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/sqlpad-compat","purlType":"apk","versions":[{"text":"< 7.4.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.4.1-r3","eol":null,"hubHref":null},{"vendor":"debian","product":"node-express","name":"node-express","label":"node-express","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-express","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.19.2+~cs8.36.21-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.19.2+~cs8.36.21-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-express","name":"node-express","label":"node-express","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-express","purlType":"deb","versions":[{"text":"< 4.1.1~dfsg-1ubuntu0.16.04.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.1.1~dfsg-1ubuntu0.18.04.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.17.1-2ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 4.17.3+~4.17.13-1ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.1~dfsg-1ubuntu0.16.04.1~esm1 | < 4.1.1~dfsg-1ubuntu0.18.04.1~esm1 | < 4.17.1-2ubuntu0.1~esm1 | < 4.17.3+~4.17.13-1ubuntu0.1~esm1","eol":null,"hubHref":null},{"vendor":"expressjs","product":"express","name":"express","label":"express","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.14.0, < 4.19.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-alpha.1, < 5.0.0-beta.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.14.0, < 4.19.0 | ≥ 5.0.0-alpha.1, < 5.0.0-beta.3","eol":null,"hubHref":"/vendor/expressjs/express"},{"vendor":"Npm","product":"express","name":"express","label":"express","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/express","purlType":"npm","versions":[{"text":"< 4.19.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.0-alpha.1, < 5.0.0-beta.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.19.2 | ≥ 5.0.0-alpha.1, < 5.0.0-beta.3","eol":null,"hubHref":null},{"vendor":"openjsf","product":"express","name":"express","label":"express","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.19.2","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha2","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha3","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha4","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha5","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha6","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha7","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:alpha8","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:beta1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:beta2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.19.2 | 5.0.0:alpha1 | 5.0.0:alpha2 | 5.0.0:alpha3 | 5.0.0:alpha4 | 5.0.0:alpha5 | 5.0.0:alpha6 | 5.0.0:alpha7 | 5.0.0:alpha8 | 5.0.0:beta1 | 5.0.0:beta2","eol":{"isEol":false,"eolDate":null,"matchMethod":"cpe","cycle":{"name":"5","label":"5","eolFrom":null,"isLts":false,"isMaintained":true,"latestVersion":"5.3.0"},"product":{"name":"express","label":"Express","category":"framework"}},"hubHref":"/vendor/openjsf/express"}],"affectedCount":38,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","label":"github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Patch","Vendor Advisory"]},{"url":"https://github.com/koajs/koa/issues/1800","label":"github.com/koajs/koa/issues/1800","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Issue Tracking"]},{"url":"https://github.com/expressjs/express/pull/5539","label":"github.com/expressjs/express/pull/5539","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Issue Tracking"]},{"url":"https://github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","label":"github.com/expressjs/express/commit/0867302ddbde0e9463d0564fea5861feb708c2dd","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","label":"github.com/expressjs/express/commit/0b746953c4bd8e377123527db11f9cd866e39f94","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://expressjs.com/en/4x/api.html#res.location","label":"expressjs.com/en/4x/api.html","hostname":"expressjs.com","tags":["X Refsource MISC","REPORT","WEB","Technical Description"]},{"url":"https://ubuntu.com/security/CVE-2024-29041","label":"ubuntu.com/security/CVE-2024-29041","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29041","label":"www.cve.org/CVERecord?id=CVE-2024-29041","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7581-1","label":"ubuntu.com/security/notices/USN-7581-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29041","label":"security-tracker.debian.org/tracker/CVE-2024-29041","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29041.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29041.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29041","label":"nvd.nist.gov/vuln/detail/CVE-2024-29041","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://github.com/expressjs/express","label":"github.com/expressjs/express","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["USN-7581-1"],"duplicates":[],"related":["CGA-5389-98XC-VR78","CGA-QG2P-WMX3-MX9Q","CGA-R5VJ-2CF3-HPWP","CGA-RJRM-49WC-V48X","CGA-W26H-H47R-F6RX","USN-7581-1"]},"timeline":[{"kind":"published","date":"2024-03-25T20:20:06.205Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T01:03:51.705Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T11:35:24.409Z","stale":false,"partial":false}}