CVE-2023-45289: Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

Deferred

AliasesUBUNTU-CVE-2023-45289DEBIAN-CVE-2023-45289CGA-2268-3fj6-7fq2+682 more

Published 05-03-2024Last modified 13-02-2025

Vulnerability summary

CVE-2023-45289 is a medium (CVSS 4.3) vulnerability in go standard library net/http. EPSS estimates a 1.08% chance of exploitation in the next 30 days, higher than 65.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.08%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 460

OPENSUSE-SU-2024:13752-1 OPENSUSE-SU-2024:13756-1 OPENSUSE-SU-2026:11436-1 RHSA-2024:0045 RHSA-2024:2562 RHSA-2024:2724+94 more

Showing 100 of 466.

Timeline

05-03-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

CVSS metrics

5 scores · 5 sources · 1 version

v3.14.3

EPSS trend

Probability

1.08%

Chance of exploitation in the next 30 days

Percentile

65%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.08% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

actions-runner-controller< 0.8.3-r1
amass< 4.2.0-r4
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.5.5-r1
atlantis-fips< 0.33.0-r6

aws-ebs-csi-driver< 1.28.0-r1
aws-efs-csi-driver< 1.7.6-r1
aws-efs-csi-driver-fips< 1.7.0-r4
aws-flb-cloudwatch< 1.9.4-r7
aws-flb-firehose< 1.7.2-r7
aws-flb-kinesis< 1.10.2-r7
aws-load-balancer-controller< 2.7.1-r1
aws-load-balancer-controller-fips< 2.7.1-r1
azure-aad-pod-identity-mic< 1.8.17-r5
bank-vaults-fips< 1.20.4-r5
bazelisk< 1.19.0-r1
bom< 0.6.0-r1
boring-registry-fips< 0.13.2-r1
buildkitd< 0.13.1-r2
caddy< 2.7.6-r3
cadvisor< 0.49.1-r3
cadvisor-compat< 0.49.1-r3
capslock< 0.2.1-r1
cass-operator< 1.18.2-r4
cass-operator-fips< 1.18.2-r3
cass-operator-fips-no-pvc-delete< 1.18.2-r4
cert-exporter< 2.12.0-r1
cert-exporter-fips< 2.12.0-r1
cfssl< 1.6.5-r0
chainctl< 0.2.59-r0
chartmuseum< 0.16.1-r4
cloud-sql-proxy-fips< 2.8.2-r1
cluster-autoscaler-1.27< 1.27.5-r2
cluster-autoscaler-1.27-compat< 1.27.5-r2
cluster-autoscaler-1.28< 1.28.2-r2
cluster-autoscaler-1.28-compat< 1.28.2-r2
cluster-proportional-autoscaler< 1.8.11-r1
cni-plugins< 1.4.0-r2
cni-plugins-fips< 1.4.0-r2
configmap-reload< 0.12.0-r4
configmap-reload-fips< 0.12.0-r3
configmap-reload-fips-0.11< 0.11.1-r4
controller-gen< 0.14.0-r1
cortex< 1.16.0-r2
cri-tools< 1.29.0-r4
crossplane-provider-azure< 0.42.1-r1
ctop< 0.7.7-r11
cue< 0.7.1-r1
cue-fips< 0.7.1-r1
dagger< 0.10.1-r1
dask-gateway< 2024.1.0-r2
dataplaneapi< 2.9.1-r1
delve< 1.22.1-r1
dex< 2.38.0-r1
dex-k8s-authenticator< 1.4.0-r7
dgraph< 23.1.0-r5
direnv< 2.34.0-r1
dive< 0.12.0-r1
docker-cli< 24.0.6-r2
docker-credential-acr-env< 0.7.0-r11
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.7.1-r9
docker-credential-gcr< 2.1.22-r1
dockerize< 0.7.0-r5
dockerize-fips< 0.7.0-r4
doppler-kubernetes-operator< 1.5.0-r1
dynamic-localpv-provisioner< 3.5.0-r4
dynamic-localpv-provisioner-fips< 3.5.0-r1
eksctl< 0.173.0-r1
envoy-ratelimit< 0.0_git20240220-r3
envoy-ratelimit-fips< 0.0_git20231206-r1
esbuild< 0.20.1-r1
etcd-3.5< 3.5.12-r1
external-secrets-fips< 0.9.13-r1
falcoctl-fips-0.4< 0.4.0-r3
ferretdb< 1.20.1-r1
flannel-cni-plugin< 1.4.0-r1
flux< 2.2.3-r1
flux-helm-controller< 0.37.4-r3
flux-image-automation-controller< 0.37.1-r1
flux-image-reflector-controller< 0.31.2-r1
fq< 0.10.0-r1
fulcio-fips< 1.4.4-r1
fuse-overlayfs-snapshotter< 1.0.8-r4
gcsfuse< 1.4.2-r1
gh< 2.45.0-r1
gitness< 3.0.0_beta5-r1
gke-gcloud-auth-plugin< 0.0.2-r7
go-1.20< 1.20.14-r9 | All versions (No fix recorded)
go-bindata< 3.1.3-r16
go-licenses< 1.6.0-r10
go-md2man< 2.0.3-r2
gobuster< 3.6.0-r5
golangci-lint< 1.56.2-r1
gomplate< 3.11.7-r1
gops< 0.3.28-r5
goreleaser< 1.24.0-r1
gosu< 1.17-r3
govulncheck< 1.0.2-r1
grafana-operator< 5.6.3-r1
grafana-operator-fips< 5.6.3-r2
grpcurl< 1.8.9-r3
grype< 0.74.7-r1
haproxy-ingress< 0.14.6-r1
hello-world-golang< 1.3-r1
helm< 3.14.2-r1
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-operator< 1.34.1-r1
helm-operator-fips< 1.34.1-r1
helm-push< 0.10.4-r4
hey< 0.1.4-r10
http-echo< 1.0.0-r4
hubble-ui< 0.13.0-r1
hubble-ui-backend< 0.13.3-r1
hubble-ui-backend-fips< 0.13.0-r1
influx< 2.7.3-r9
ip-masq-agent< 2.9.3-r7
jsonnet-bundler< 0.5.1-r2
k3d< 5.6.0-r7
k3s< 1.29.2-r1
k8sgpt< 0.3.27-r3
k8sgpt-operator< 0.1.0-r1
k8ssandra-operator< 1.13.0-r1
k8ssandra-operator-fips< 1.13.0-r1
kaf< 0.2.7-r1
kiam< 4.2-r7
kind< 0.22.0-r2
kine< 0.11.3-r2
kor< 0.3.6-r1
kpt< 1.0.0_beta49-r1
kube-bench< 0.7.2-r1
kube-logging-logging-operator-3.17< 3.17.11-r6
kube-logging-logging-operator-4.1< 4.1.0-r4
kube-logging-operator< 4.5.6-r1
kube-oidc-proxy< 1.0.6-r4
kube-rbac-proxy< 0.16.0-r1
kube-rbac-proxy-fips< 0.16.0-r1
kube-state-metrics< 2.11.0-r0
kube-state-metrics-fips< 2.10.1-r3
kubebuilder< 3.14.0-r2
kubeflow-katib< 0.16.0-r5
kubeflow-pipelines< 2.0.5-r4
kuberay-operator< 1.0.0-r2
kubernetes-csi-external-provisioner< 4.0.0-r1
kubernetes-csi-external-resizer< 1.10.0-r2
kubernetes-csi-livenessprobe< 2.12.0-r1
kubernetes-csi-livenessprobe-2.10< 2.10.0-r6
kubernetes-csi-livenessprobe-fips< 2.11.0-r6
kubernetes-csi-livenessprobe-fips-2.10< 2.10.0-r6
kubernetes-dashboard< 2.7.0-r12
kubernetes-dashboard-fips< 2.7.0-r1
kubernetes-dashboard-metrics-scraper< 1.0.9-r11
kubernetes-dashboard-metrics-scraper-compat< 1.0.9-r11
kubernetes-dashboard-metrics-scraper-fips< 1.0.9-r1
kubernetes-dns-node-cache< 1.23.0-r1
kubernetes-event-exporter< 1.7-r2
kubevela< 1.9.9-r2
kubewatch< 2.5.0-r10
kustomize< 5.3.0-r2
kwok< 0.5.1-r1
kyverno-policy-reporter< 2.18.1-r1
kyverno-policy-reporter-kyverno-plugin< 1.6.3-r1
lazygit< 0.40.2-r2
litefs< 0.5.11-r1
local-path-provisioner< 0.0.26-r3
logstash-exporter< 1.6.3-r1
logstash-exporter-fips< 1.6.1-r1
mage< 1.15.0-r5
mc-fips< 0.20240131.085940-r1
memcached-exporter< 0.14.2-r2
metallb< 0.14.3-r1
metrics-server< 0.7.0-r1
metrics-server-fips< 0.6.4-r4
minio< 0.20231220.010002-r3
minio-fips< 0.20240131.202033-r1
mockery< 2.42.0-r1
mongo-tools< 100.9.4-r2
nats< 0.1.3-r1
nats-server< 2.10.11-r1
nerdctl< 1.7.4-r1
newrelic-fluent-bit-output< 1.19.2-r1
newrelic-fluent-bit-output-compat< 2.4.0-r5
newrelic-infra-operator< 0.18.0-r1
newrelic-infrastructure-agent< 1.50.0-r1
newrelic-prometheus-configurator< 1.14.0-r1
nfs-subdir-external-provisioner< 4.0.18-r4
nfs-subdir-external-provisioner-fips< 4.0.18-r3
node-problem-detector-0.8< 0.8.17-r0
nodetaint< 0.0.4-r11
nri-apache< 1.12.3-r1
nri-cassandra< 2.13.4-r1
nri-couchbase< 2.6.1-r5
nri-discovery-kubernetes< 1.7.2-r3
nri-elasticsearch< 5.2.3-r1
nri-f5< 2.7.3-r1
nri-haproxy< 3.0.0-r1
nri-kafka< 3.7.1-r1
nri-memcached< 2.5.3-r1

Show all 199

Alpine1 product

go< 1.21.8-r0 | < 1.22.1-r0

2 vendors · 200 products · Showing 200 of 564

References

15 links

Show all 15 references

www.cve.org/CVERecord?id=CVE-2023-45289REPORT
ubuntu.com/security/notices/USN-6886-1Advisory
security-tracker.debian.org/tracker/CVE-2023-45289Advisory
nvd.nist.gov/vuln/detail/CVE-2023-45289OvalAdvisory
security.alpinelinux.org/vuln/CVE-2023-45289Advisory