VDB
RHEA-2024%3A3997
RHEA-2024%3A3997
PUBLISHED
CVSS 6.5 MEDIUM
A vulnerability was found in the follow-redirects package. While processing the cross-domain redirection, `follow-redirects` clears authorization headers, however, it misses clearing proxy-authentication headers, which contain credentials as well. This issue may lead to credential leaking, having a high impact on data confidentiality.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-pipelines/pipelines-entrypoint-rhel8@sha256:a8386cbdf798d06b1397d5355c35f88ae1cc78342d76a383135ef9777662273c_arm64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-entrypoint-rhel8@sha256:a8386cbdf798d06b1397d5355c35f88ae1cc78342d76a383135ef9777662273c_arm64 |
| Red Hat | openshift-pipelines/pipelines-entrypoint-rhel8@sha256:61a05125edb512676515a3304433ae35bb6160bb07210ea2d768a93a07670171_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-entrypoint-rhel8@sha256:61a05125edb512676515a3304433ae35bb6160bb07210ea2d768a93a07670171_ppc64le |
| Red Hat | openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:bb2c07bfcb1457ec6bd1b661f7ee8bf8b6aae572cfc520000fbc91a1534339da_amd64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-triggers-controller-rhel8@sha256:bb2c07bfcb1457ec6bd1b661f7ee8bf8b6aae572cfc520000fbc91a1534339da_amd64 |
| Red Hat | openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:861201ee645f1cd6d0ff67155383c6c99d246a60a9baa98f0b07bb408df8285f_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:861201ee645f1cd6d0ff67155383c6c99d246a60a9baa98f0b07bb408df8285f_ppc64le |
| Red Hat | openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:30fe994fca45ab449286dbd0b5e9fae52dea2971894d61feb995a698e7ec875b_s390x as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-triggers-core-interceptors-rhel8@sha256:30fe994fca45ab449286dbd0b5e9fae52dea2971894d61feb995a698e7ec875b_s390x |
| Red Hat | openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:0b9b3325f6049f1e38387a57c9e07d3505b826cb2b4b032761b6305bb05fc372_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | * |
| Red Hat | openshift-pipelines/pipelines-operator-proxy-rhel8@sha256:9dd736fb9993559e03fa27c1742d75888af99d07bcff92e33a6cc4397c4bcd70_arm64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | * |
| Red Hat | openshift-pipelines/pipelines-resolvers-rhel8@sha256:c73fd80294e598e4b1e7e3f0fb08887c44096e76852a50aa67d4236633835410_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-resolvers-rhel8@sha256:c73fd80294e598e4b1e7e3f0fb08887c44096e76852a50aa67d4236633835410_ppc64le |
| Red Hat | openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:806d313087647a0b47c1515ca03bf865f6d2c5cc2204da4b9937d9fe14f229f3_s390x as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:806d313087647a0b47c1515ca03bf865f6d2c5cc2204da4b9937d9fe14f229f3_s390x |
| Red Hat | openshift-pipelines/pipelines-webhook-rhel8@sha256:4691546410274703396ae94aac807bc532959f16acda0ea63ce7bcbe86798438_amd64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-webhook-rhel8@sha256:4691546410274703396ae94aac807bc532959f16acda0ea63ce7bcbe86798438_amd64 |
| Red Hat | openshift-pipelines/pipelines-hub-api-rhel8@sha256:d4f932dc9e5bc418b3d33f334ad67c5ed3f35a00d4cfbc74dea6e92ef6eff00c_amd64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-hub-api-rhel8@sha256:d4f932dc9e5bc418b3d33f334ad67c5ed3f35a00d4cfbc74dea6e92ef6eff00c_amd64 |
| Red Hat | openshift-pipelines/pipelines-manual-approval-gate-rhel8@sha256:e207d39c2ece8f00499e178752acba6571b5c35aefc82397069655d4ff830c7d_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-manual-approval-gate-rhel8@sha256:e207d39c2ece8f00499e178752acba6571b5c35aefc82397069655d4ff830c7d_ppc64le |
| Red Hat | openshift-pipelines/pipelines-console-plugin-rhel8@sha256:dc127a76c0325ec669a333142f82e795f78264bf8b425ccf838898bf397efdb4_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-console-plugin-rhel8@sha256:dc127a76c0325ec669a333142f82e795f78264bf8b425ccf838898bf397efdb4_ppc64le |
| Red Hat | openshift-pipelines/pipelines-events-rhel8@sha256:5cd167667e1a028d39230b9a019a2208419434279dbaa4877cd91e6fd8c67f7d_s390x as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-events-rhel8@sha256:5cd167667e1a028d39230b9a019a2208419434279dbaa4877cd91e6fd8c67f7d_s390x |
| Red Hat | openshift-pipelines/pipelines-console-plugin-rhel8@sha256:bd93af975dcb95791f46bc325c00cdf6810d56c3d4373bc4268a4a52755badc1_amd64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-console-plugin-rhel8@sha256:bd93af975dcb95791f46bc325c00cdf6810d56c3d4373bc4268a4a52755badc1_amd64 |
| Red Hat | openshift-pipelines/pipelines-results-watcher-rhel8@sha256:c8a2482ac4a9a6996c7715de1020c38557071850a41fc05d6cc185c7f4100c36_amd64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | * |
| Red Hat | openshift-pipelines/pipelines-cli-tkn-rhel8@sha256:e6c8593d1551f08f387eb96f2250ac14cec73dd77ad3634b1463c0fb2515041a_ppc64le as a component of OpenShift Pipelines version 1.15 for RHEL 8 | * |
| Red Hat | openshift-pipelines/pipelines-pipelines-as-code-rhel8@sha256:1a762dd6ed0fbf197ccf731cc6690104e49d17d8cc1dd6d2ba2da1721b1e09ae_arm64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-pipelines-as-code-rhel8@sha256:1a762dd6ed0fbf197ccf731cc6690104e49d17d8cc1dd6d2ba2da1721b1e09ae_arm64 |
| Red Hat | openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:89e2c4e6481d1163be199e02022074d314fac48f8cc046685f56299d906c5ebb_s390x as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:89e2c4e6481d1163be199e02022074d314fac48f8cc046685f56299d906c5ebb_s390x |
| Red Hat | openshift-pipelines/pipelines-operator-bundle@sha256:22be152950501a933fe6e1df0e663c8056ca910a89dab3ea801c3bb2dc2bf1e6_amd64 as a component of OpenShift Pipelines version 1.15 for RHEL 8 | openshift-pipelines/pipelines-operator-bundle@sha256:22be152950501a933fe6e1df0e663c8056ca910a89dab3ea801c3bb2dc2bf1e6_amd64 |
…and 196 more
Timeline
- Jun 20, 2024 CVE Published
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
- May 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHEA-2024:3997 advisory
- https://docs.openshift.com/container-platform/4.14/cicd/pipelines/understanding-openshift-pipelines.html advisory
- https://issues.redhat.com/browse/SRVKP-3123 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhea-2024_3997.json advisory
- https://access.redhat.com/security/cve/CVE-2024-28849 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2269576 issue
- https://www.cve.org/CVERecord?id=CVE-2024-28849 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-28849 advisory
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp advisory