VDB
RHBA-2024%3A2034
RHBA-2024%3A2034
PUBLISHED
CVSS 6.5 MEDIUM
A vulnerability was found in the follow-redirects package. While processing the cross-domain redirection, `follow-redirects` clears authorization headers, however, it misses clearing proxy-authentication headers, which contain credentials as well. This issue may lead to credential leaking, having a high impact on data confidentiality.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/acm-must-gather-rhel9@sha256:9d077e2c27db13840339b4820bca70cd718b23dbc12beabf82ac2581458f4e2c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/acm-must-gather-rhel9@sha256:9d077e2c27db13840339b4820bca70cd718b23dbc12beabf82ac2581458f4e2c_ppc64le |
| Red Hat | rhacm2/metrics-collector-rhel9@sha256:c9e30c02d58c1c8302c2377cf83489030f80c84b624251992b71706b225f4e00_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/metrics-collector-rhel9@sha256:c9e30c02d58c1c8302c2377cf83489030f80c84b624251992b71706b225f4e00_arm64 |
| Red Hat | rhacm2/config-policy-controller-rhel9@sha256:485d8f6b867f6b1ea1cdce3bd0af00c663e6c4b157d8f76164f1c8069aeba678_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | * |
| Red Hat | rhacm2/grafana-dashboard-loader-rhel9@sha256:f04a562407de8c67eb72beb240b36d0bf25cb290f7096872c7f1a54f5e76f058_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/grafana-dashboard-loader-rhel9@sha256:f04a562407de8c67eb72beb240b36d0bf25cb290f7096872c7f1a54f5e76f058_arm64 |
| Red Hat | rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:eb56cb552b6ae9a8aa6792b14d96550fe2bda42cc8522b8775f274549bc2354b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:eb56cb552b6ae9a8aa6792b14d96550fe2bda42cc8522b8775f274549bc2354b_arm64 |
| Red Hat | rhacm2/insights-metrics-rhel9@sha256:72ea12999eed9b6e932109b93018be19eed9ad4ca6efb2e8ddb028b7d3fd8526_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/insights-metrics-rhel9@sha256:72ea12999eed9b6e932109b93018be19eed9ad4ca6efb2e8ddb028b7d3fd8526_s390x |
| Red Hat | rhacm2/acm-prometheus-config-reloader-rhel9@sha256:a1223f646ee868d24017a65dc87fe96f6d3d4a1caaf23ce2bffa8c0a58278f44_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | * |
| Red Hat | rhacm2/insights-client-rhel9@sha256:698de10cfbf0fce72eba97ffd3b02dce7d5b470b7ebb972ada20296e746e658c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/insights-client-rhel9@sha256:698de10cfbf0fce72eba97ffd3b02dce7d5b470b7ebb972ada20296e746e658c_arm64 |
| Red Hat | rhacm2/multicluster-operators-channel-rhel9@sha256:44d4c4d7e0e6e70bca0723565fec0b5a194b28576a93d2ab9dab5293ce1bca8f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/multicluster-operators-channel-rhel9@sha256:44d4c4d7e0e6e70bca0723565fec0b5a194b28576a93d2ab9dab5293ce1bca8f_s390x |
| Red Hat | rhacm2/acm-search-v2-api-rhel9@sha256:bb0a7c8bfb10f7cee78a32b3afa478ba5d25a01d18ef0a88e3332e4ce78d084d_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/acm-search-v2-api-rhel9@sha256:bb0a7c8bfb10f7cee78a32b3afa478ba5d25a01d18ef0a88e3332e4ce78d084d_s390x |
| Red Hat | rhacm2/console-rhel9@sha256:a707c9134d3d40c72a05d59bd407ac6b4e04412b2a518abf568e713859ea5891_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/console-rhel9@sha256:a707c9134d3d40c72a05d59bd407ac6b4e04412b2a518abf568e713859ea5891_ppc64le |
| Red Hat | rhacm2/insights-metrics-rhel9@sha256:479558158bd5f1d11c17b3dfb37450b7beb172d49c7cb240952d01e5002034cf_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/insights-metrics-rhel9@sha256:479558158bd5f1d11c17b3dfb37450b7beb172d49c7cb240952d01e5002034cf_arm64 |
| Red Hat | rhacm2/klusterlet-addon-controller-rhel9@sha256:f24c2560e12b8108de62cd0f2d8314f0074f7d7cea6ad432bb927affae76a468_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/klusterlet-addon-controller-rhel9@sha256:f24c2560e12b8108de62cd0f2d8314f0074f7d7cea6ad432bb927affae76a468_amd64 |
| Red Hat | rhacm2/acm-must-gather-rhel9@sha256:930a1be2fc03f4dca8826593a28feb3e44a1a10592cefae0077c815cb6bf1001_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/acm-must-gather-rhel9@sha256:930a1be2fc03f4dca8826593a28feb3e44a1a10592cefae0077c815cb6bf1001_amd64 |
| Red Hat | rhacm2/prometheus-alertmanager-rhel9@sha256:389da10417fb47d51239b823285f6c2707d2af4b242f898856e72e12cf443b74_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | * |
| Red Hat | rhacm2/observatorium-rhel9-operator@sha256:adb3aec1f0238b3a9bc96843e9d15019a4af43b998821f4199a7a19f06a10035_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | * |
| Red Hat | rhacm2/submariner-addon-rhel9@sha256:2746b4177ddd7d936dd2c496732cbe0f71af19c032f2d064d73e7034da5cceda_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/submariner-addon-rhel9@sha256:2746b4177ddd7d936dd2c496732cbe0f71af19c032f2d064d73e7034da5cceda_s390x |
| Red Hat | rhacm2/prometheus-rhel9@sha256:4e27b9d66faa3dfc56622081f2e1f752c6c4a3f42fe27fe2597facd70072c18b_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/prometheus-rhel9@sha256:4e27b9d66faa3dfc56622081f2e1f752c6c4a3f42fe27fe2597facd70072c18b_arm64 |
| Red Hat | rhacm2/console-rhel9@sha256:be342c1ecd09ef2c61cc29e9d9ae92835b7ed00620c52f6e8521c05dd21a3624_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/console-rhel9@sha256:be342c1ecd09ef2c61cc29e9d9ae92835b7ed00620c52f6e8521c05dd21a3624_arm64 |
| Red Hat | rhacm2/search-collector-rhel9@sha256:9f9dafffba92aa5bdb5725f57c7f5b862f56f9f876d401289e30cb0d3a12f617_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | rhacm2/search-collector-rhel9@sha256:9f9dafffba92aa5bdb5725f57c7f5b862f56f9f876d401289e30cb0d3a12f617_amd64 |
…and 330 more
Timeline
- Apr 24, 2024 CVE Published
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHBA-2024:2034 advisory
- https://issues.redhat.com/browse/ACM-10406 advisory
- https://issues.redhat.com/browse/ACM-10806 advisory
- https://issues.redhat.com/browse/ACM-10811 advisory
- https://issues.redhat.com/browse/ACM-10967 advisory
- https://issues.redhat.com/browse/ACM-11008 advisory
- https://issues.redhat.com/browse/ACM-11071 advisory
- https://issues.redhat.com/browse/HYPBLD-309 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_2034.json advisory
- https://access.redhat.com/security/cve/CVE-2024-28849 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2269576 issue
- https://www.cve.org/CVERecord?id=CVE-2024-28849 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-28849 advisory
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp advisory