> CVE-2024-45336 [MEDIUM]

« BACK_TO_HOME
PUBLISHED
2025-01-28 02:15
MODIFIED
2025-02-21 18:15
CVSS_SCORE V3
6.1
EPSS (Prob. Exploit)
0.73%
Top 46.4%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 OSV 🔗 2026-03-01

> DESCRIPTION

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 1.24.1
Red Hat - Red Hat Enterprise Linux 10
Version: 1.23.7
Red Hat - Red Hat Enterprise Linux 10
Version: 0.4.5
Red Hat - Red Hat Enterprise Linux 10
Version: 0.3.2
Red Hat - Red Hat Enterprise Linux 8
Red Hat - Red Hat Enterprise Linux 9
Version: 0.107.0
Red Hat - Red Hat Enterprise Linux 9
Version: 1.24.1
Red Hat - Red Hat Enterprise Linux 9
Version: 1.23.6
Red Hat - Red Hat Enterprise Linux 9
Version: 0.2.6
Red Hat - Red Hat Enterprise Linux 9.4 Extended Update Support
Version: 0.107.0
Red Hat - Red Hat OpenShift distributed tracing 3.5.2
Red Hat - Red Hat Ceph Storage 7.1
Red Hat - Red Hat Ceph Storage 7.1
Version: 7
Red Hat - Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
Red Hat - Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
Red Hat - RHOL-6.1-RHEL-9
Red Hat - Red Hat OpenShift Service Mesh 2.5 for RHEL 8
Red Hat - Satellite Client 6 for RHEL 8
Version: 0.2.3
Red Hat - Satellite Client 6 for RHEL 9
Version: 0.2.3

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
None (N)
Aucune authentification requise
UI (Interaction Utilisateur)
User Interaction
Required (R)
Nécessite une action utilisateur (clic lien, ouverture fichier, etc.)
S (Périmètre)
Scope
Changed (C)
Impact s'étend au-delà du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
Low (L)
Divulgation limitée d'informations
I (Impact Intégrité)
Integrity Impact
Low (L)
Modification limitée des données possible
A (Impact Disponibilité)
Availability Impact
None (N)
Aucune interruption de service

> RÉSUMÉ DES IMPACTS

Confidentialité
Low
Divulgation limitée d'informations
Intégrité
Low
Modification limitée des données possible
Disponibilité
None
Aucune interruption de service

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS...
Red Hat Security Advisory: yggdrasil security update
An update for yggdrasil is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syste...
Red Hat Security Advisory: delve and golang security update
An update for delve and golang is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring...
Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS)...
Red Hat Security Advisory: RHSA: Submariner 0.18.5 - bug and security update
Submariner 0.18 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.11. Red Hat Product Security has ra...
Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.7 container updates
Red Hat Advanced Cluster Management for Kubernetes 2.11.7 General Availability release images, with updates to container images and bug fixes. Red Hat Product Security has rated this update as having...
Red Hat Security Advisory: Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
Updated rhceph-7.1 container image is now available in the Red Hat Ecosystem Catalog.
Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.5.10
Red Hat OpenShift Service Mesh Containers for 2.5.10 This update has a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is...
Red Hat Security Advisory: go-toolset:rhel8 security update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerabili...
Red Hat Security Advisory: delve and golang security update
An update for delve and golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Importan...
Red Hat Security Advisory: opentelemetry-collector security update
An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.1.4
Logging for Red Hat OpenShift - 6.1.4
Red Hat Enhancement Advisory: RHEA: Submariner 0.19.3 - bug fix and enhancement update
Submariner 0.19.3 packages that fix various bugs and add various enhancements that are now available for Red Hat Advanced Cluster Management for Kubernetes version 2.12
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.5.0 release
Red Hat build of OpenTelemetry 3.5.0 has been released
Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.5 security update
Red Hat multicluster engine for Kubernetes v2.10 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update
Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.14 security update
Red Hat multicluster engine for Kubernetes v2.6 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.7 security update
Red Hat multicluster engine for Kubernetes v2.9 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.10 security update
Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this upd...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.6 security update
Red Hat multicluster engine for Kubernetes v2.10 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.6 security update
Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this up...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product...
Red Hat Security Advisory: osbuild-composer security update
An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Re...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Pro...
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red H...
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life...
Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Secur...
Red Hat Security Advisory: grafana-pcp security update
An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat...
Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security...
Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Pro...
Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product...
Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product...
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life...
Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has...
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.2 release.
Red Hat Web Terminal Operator 1.14.2 has been released.
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.11.3 release.
Red Hat Web Terminal Operator 1.11.3 has been released.
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.13.2 release.
Red Hat Web Terminal Operator 1.13.2 has been released.
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Pro...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

ALIASES:
BIT-golang-2024-45336, GO-2025-3420

> HISTORIQUE DES MODIFICATIONS

Première apparition
28/01/2025 02:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 14:58
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:26
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:26
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME