CVE-2024-45336

Description

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.67%• Percentile: 51%

Affected Systems

• chainguard•aactl

  < 0.4.12-r22

• chainguard•actions-runner-controller

  < 0.10.1-r2

• chainguard•actions-runner-controller-fips

  < 0.10.1-r2

• chainguard•age

  < 1.2.1-r1

• chainguard•age-fips

  < 1.2.1-r1

• chainguard•amazon-cloudwatch-agent-fips

  < 1.300052.0-r0

• chainguard•amazon-k8s-cni

  < 1.19.2-r1

• chainguard•amazon-k8s-cni-fips

  < 1.19.2-r2

• chainguard•amazon-k8s-cni-init-fips

  < 1.19.2-r2

• chainguard•amazon-k8s-cni-init-fips-compat

  < 1.19.2-r2

• chainguard•ansible-operator

  < 1.37.1-r1

• chainguard•apache-beam-java-sdk

  < 2.62.0-r0

• chainguard•apache-beam-python-3.11-sdk

  < 2.62.0-r0

• chainguard•argo-events

  < 1.9.5-r1

• chainguard•argo-events-fips

  < 1.9.5-r1

• chainguard•argo-rollouts

  < 1.7.2-r4

• chainguard•argo-workflows

  < 3.6.3-r1

• chainguard•argo-workflows-fips

  < 3.6.2-r4

• chainguard•atlantis

  < 0.32.0-r1

• chainguard•atlantis-fips

  < 0.32.0-r1

• chainguard•authservice-fips

  < 1.0.4-r0

• chainguard•aws-application-networking-k8s

  < 1.1.0-r2

• chainguard•aws-ebs-csi-driver

  < 1.52.1-r0

• chainguard•aws-efs-csi-driver

  < 2.1.4-r1

• chainguard•aws-efs-csi-driver-fips

  < 2.1.4-r1

• chainguard•aws-flb-cloudwatch

  < 1.9.4-r14

• chainguard•aws-flb-cloudwatch-compat-fips

  < 1.9.4-r7

• chainguard•aws-flb-cloudwatch-fips

  < 1.9.4-r7

• chainguard•aws-flb-firehose

  < 1.7.2-r14

• chainguard•aws-flb-firehose-fips

  < 1.7.2-r7

• chainguard•aws-flb-kinesis

  < 1.10.2-r15

• chainguard•aws-flb-kinesis-fips

  < 1.10.2-r8

• chainguard•aws-load-balancer-controller

  < 2.11.0-r2

• chainguard•aws-load-balancer-controller-fips

  < 2.12.0-r1

• chainguard•aws-network-policy-agent

  < 1.1.6-r1

• chainguard•aws-network-policy-agent-fips

  < 1.1.6-r1

• chainguard•aws-privateca-issuer

  < 1.4.0-r3

• chainguard•aws-privateca-issuer-fips

  < 1.4.0-r3

• chainguard•aws-signer-notation-plugin

  < 1.0.350-r1

• chainguard•aws-signer-notation-plugin-fips

  < 1.0.350-r1

• chainguard•azure-aad-pod-identity-mic

  < 1.8.17-r16

• chainguard•azuredisk-csi-1.28

  < 1.28.11-r6

• chainguard•azuredisk-csi-1.29

  < 1.29.12-r1

• chainguard•azuredisk-csi-1.30

  < 1.30.7-r1

• chainguard•azuredisk-csi-1.31

  < 1.31.2-r1

• chainguard•azuredisk-csi-fips-1.28

  < 1.28.11-r5

• chainguard•azuredisk-csi-fips-1.29

  < 1.29.12-r1

• chainguard•azuredisk-csi-fips-1.30

  < 1.30.7-r1

• chainguard•azuredisk-csi-fips-1.31

  < 1.31.2-r1

• chainguard•bank-vaults

  < 1.20.4-r23

Showing first 50 affected entries in server-rendered view.

References (16)

• https://go.dev/cl/643100
• https://go.dev/issue/70530
• https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
• https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
• https://pkg.go.dev/vuln/GO-2025-3420
• https://security.netapp.com/advisory/ntap-20250221-0003/
• https://access.redhat.com/errata/RHSA-2025:9514
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2341751
• https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9514.json
• https://access.redhat.com/security/cve/CVE-2024-45336
• https://www.cve.org/CVERecord?id=CVE-2024-45336
• https://nvd.nist.gov/vuln/detail/CVE-2024-45336
• https://github.com/golang/go/issues/70530
• https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI
• https://security-tracker.debian.org/tracker/CVE-2024-45336