CVE-2024-45336
mediumPriorität · verfolgen · 0EPSS 0.007 · 54. PerzentilDEEUFRRUUSEPSS · bewertet 2026-10-27
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobengovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Behobengovulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (49)
Betroffene Produkte und Versionsbereiche.
- Red Hat Enterprise Linux Multicluster Engine for Kubernetesalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:multicluster_engine_for_kubernetes
Advisories (6)
Hersteller- und Ökosystem-Meldungen dazu.
- SUSE-SU-2025:0297-1Security update for govulncheck-vulndb2025-01-30csaf · suse_csafDE
Security update for govulncheck-vulndb
- SUSE-SU-2025:0429-1Security update for govulncheck-vulndb2025-02-11csaf · suse_csafDE
Security update for govulncheck-vulndb
- WID-SEC-W-2025-0111Golang Go: Mehrere SchwachstellenDeutsch2025-01-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.
- BIT-golang-2024-45336Sensitive headers incorrectly sent after cross-domain redirect in net/http2025-01-30vendor · osvUS
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
- CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
- GO-2025-3420Sensitive headers incorrectly sent after cross-domain redirect in net/http2025-01-28vendor · osvUS
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
- CNNVD-202501-3923cnnvd
- EUVD-2024-41740enisa_euvd
- BDU:2025-02667fstec_bdu
- GHSA-7wrw-r4p8-38rxenisa_euvd
- BIT-golang-2024-45336osv
- GO-2025-3420osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (17)
Externe Belege — Patches, Meldungen, Analysen.
- https://go.dev/cl/643100cnnvd
- https://go.dev/issue/70530cnnvd
- https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJcnnvd
- https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJcnnvd
- https://pkg.go.dev/vuln/GO-2025-3420cnnvd
- https://vigilance.fr/vulnerability/Go-two-vulnerabilities-dated-16-01-2025-46177cnnvd
- https://go.dev/cl/643100enisa_euvd
- https://go.dev/issue/70530enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan