VDB

RHBA-2024%3A2862

RHBA-2024%3A2862 PUBLISHED CVSS 6.5 MEDIUM

A vulnerability was found in the follow-redirects package. While processing the cross-domain redirection, `follow-redirects` clears authorization headers, however, it misses clearing proxy-authentication headers, which contain credentials as well. This issue may lead to credential leaking, having a high impact on data confidentiality.

Risk Scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red Hatmulticluster-engine/aws-encryption-provider-rhel9@sha256:e666da0ffdc45cdeecd7bffee065fa8b162a233e9b29b3cb054fe513355fbfff_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/aws-encryption-provider-rhel9@sha256:e666da0ffdc45cdeecd7bffee065fa8b162a233e9b29b3cb054fe513355fbfff_s390x
Red Hatmulticluster-engine/must-gather-rhel9@sha256:df65bed4f21631bccb868c73c5b5f4adeb26b517ea695e5947318c8a9bb64191_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/must-gather-rhel9@sha256:df65bed4f21631bccb868c73c5b5f4adeb26b517ea695e5947318c8a9bb64191_amd64
Red Hatmulticluster-engine/apiserver-network-proxy-rhel9@sha256:10b92200001ae175965d4f9a9bfb076452183f7a581a2c511e824c86f14c59ab_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/apiserver-network-proxy-rhel9@sha256:10b92200001ae175965d4f9a9bfb076452183f7a581a2c511e824c86f14c59ab_s390x
Red Hatmulticluster-engine/hypershift-rhel9-operator@sha256:dfde76038acdf63c042c0357f736c6f9cf6a8f5f22dd6a872d0bc37e745cb3fd_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9*
Red Hatmulticluster-engine/multicluster-engine-hypershift-addon-rhel9-operator@sha256:1a59dfdf75d4505be5a2663860bbd091f0a2edd62579e07ee513e313eb258b6c_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/multicluster-engine-hypershift-addon-rhel9-operator@sha256:1a59dfdf75d4505be5a2663860bbd091f0a2edd62579e07ee513e313eb258b6c_ppc64le
Red Hatmulticluster-engine/assisted-image-service-rhel8@sha256:7839792ac54cba4f85abcb3630d926fbd1f82d45dd79ef33073ccafc52a024bb_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 8multicluster-engine/assisted-image-service-rhel8@sha256:7839792ac54cba4f85abcb3630d926fbd1f82d45dd79ef33073ccafc52a024bb_ppc64le
Red Hatmulticluster-engine/multicluster-engine-console-mce-rhel9@sha256:eacfdd6968fb87395c4ce2127510bd472753f68bde1f60a399e496ace2567d99_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9*
Red Hatmulticluster-engine/provider-credential-controller-rhel9@sha256:7522bdf08f9d6b321b89a5e0c82245dadb12d65fd3235d868840fccbf60c1f00_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/provider-credential-controller-rhel9@sha256:7522bdf08f9d6b321b89a5e0c82245dadb12d65fd3235d868840fccbf60c1f00_s390x
Red Hatmulticluster-engine/clusterclaims-controller-rhel9@sha256:519d8fcbc24fddfff628694fb776d877026da23d84538352f9f896cf86af6127_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9*
Red Hatmulticluster-engine/registration-rhel9@sha256:145487f570d573f075ea7c8ceb119190a2be1956cee6c8c4d9aa0d13998b9a0b_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/registration-rhel9@sha256:145487f570d573f075ea7c8ceb119190a2be1956cee6c8c4d9aa0d13998b9a0b_arm64
Red Hatmulticluster-engine/cluster-api-provider-aws-rhel9@sha256:961bf4a0c4d2d32c35af90a4c3312404af082e06843b075032add0f20a167d32_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/cluster-api-provider-aws-rhel9@sha256:961bf4a0c4d2d32c35af90a4c3312404af082e06843b075032add0f20a167d32_arm64
Red Hatmulticluster-engine/multicluster-engine-managed-serviceaccount-rhel9@sha256:8dd1b37c76152633faaf908c1963d084f1dca1d36394c1bf937b711f680139ae_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/multicluster-engine-managed-serviceaccount-rhel9@sha256:8dd1b37c76152633faaf908c1963d084f1dca1d36394c1bf937b711f680139ae_s390x
Red Hatmulticluster-engine/apiserver-network-proxy-rhel9@sha256:ff8d428cdc4294807463538ee85d353ab92732f568cd8835c0552ec25d430a01_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/apiserver-network-proxy-rhel9@sha256:ff8d428cdc4294807463538ee85d353ab92732f568cd8835c0552ec25d430a01_arm64
Red Hatmulticluster-engine/registration-rhel9@sha256:541bb962c088adece1a81a1da0867b1c54361360ff20a098202881e61bc64e38_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/registration-rhel9@sha256:541bb962c088adece1a81a1da0867b1c54361360ff20a098202881e61bc64e38_ppc64le
Red Hatmulticluster-engine/registration-rhel9@sha256:a9148a095ff646e61fc2cfa673b47f0b8f741db9e803d6c89837fcc23127e42c_s390x as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/registration-rhel9@sha256:a9148a095ff646e61fc2cfa673b47f0b8f741db9e803d6c89837fcc23127e42c_s390x
Red Hatmulticluster-engine/discovery-rhel9@sha256:915d5e3550b1fe62077f75a5ca62d19c99bca5b907db85de03ae3c1c2e5c39e0_amd64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/discovery-rhel9@sha256:915d5e3550b1fe62077f75a5ca62d19c99bca5b907db85de03ae3c1c2e5c39e0_amd64
Red Hatmulticluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:bd14b84c7c9156619389d3756beba94dd90b36114f7af1c45e0c1096ddef686b_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:bd14b84c7c9156619389d3756beba94dd90b36114f7af1c45e0c1096ddef686b_arm64
Red Hatmulticluster-engine/addon-manager-rhel9@sha256:511dfc0c5a4001018ff7d1de139c391dd2de1b01aa7afbb21039a888e94c9013_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/addon-manager-rhel9@sha256:511dfc0c5a4001018ff7d1de139c391dd2de1b01aa7afbb21039a888e94c9013_ppc64le
Red Hatmulticluster-engine/cluster-curator-controller-rhel9@sha256:c11d01fe24e258a087f89ab67f46478b510036e7050af06a013e1d2175eaa7d3_ppc64le as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/cluster-curator-controller-rhel9@sha256:c11d01fe24e258a087f89ab67f46478b510036e7050af06a013e1d2175eaa7d3_ppc64le
Red Hatmulticluster-engine/image-based-install-rhel9@sha256:0f89c5addcfa3ec2109604abb6be5e99e74d9016e07abc831b8fe1154574042f_arm64 as a component of multicluster engine for Kubernetes 2.5 for RHEL 9multicluster-engine/image-based-install-rhel9@sha256:0f89c5addcfa3ec2109604abb6be5e99e74d9016e07abc831b8fe1154574042f_arm64

…and 316 more

Timeline

  • May 15, 2024 CVE Published
  • Apr 25, 2026 Security Advisory
  • Apr 25, 2026 Security Advisory
  • Apr 30, 2026 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›