VDB
RHSA-2025%3A1609
RHSA-2025%3A1609
PUBLISHED
CVSS 6.099999904632568 MEDIUM
An Improper Input Validation flaw was found in follow-redirects due to the improper handling of URLs by the url.parse() function. When a new URL() throws an error, it can be manipulated to misinterpret the hostname. This issue could allow an attacker to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:d186268cdfcf15cc98e28555eef9b0cb6d082e3a9561346f05da62dd74bfdf32_arm64 as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/logging-console-plugin-6-0-rhel9@sha256:55708cd50ae3df2238f31fa59cd4c3b5b3c223931631472501b82cf75350da53_ppc64le as a component of Cluster Observability Operator 1.0.0 | * |
| Red Hat | registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel8@sha256:febec2fcf995293b2279b4a81fe3cf836a6b88139126f01c194d358c2048dac1_ppc64le as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel8@sha256:febec2fcf995293b2279b4a81fe3cf836a6b88139126f01c194d358c2048dac1_ppc64le |
| Red Hat | registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:6481c593929a608b834f34fca5be1d4e916be06911b98a17e66af7064cff85a9_arm64 as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:6481c593929a608b834f34fca5be1d4e916be06911b98a17e66af7064cff85a9_arm64 |
| Red Hat | registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:fd934560d184639a5c9567e53cce0f8e863476c0f59f846e2ffd4d8bff9a672c_amd64 as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:14ec62625ed452a305b532556f8c9e5edfec36603221b55e364b5ff3a336577f_s390x as a component of Cluster Observability Operator 1.0.0 | *, * |
| follow-redirects | ||
| Red Hat | registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-admission-webhook-rhel8@sha256:8c99a3d5cf0ce275326a803f02a8f3c3fee86561918679ce32f9420a511c7944_ppc64le as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:4219479d343e0889653411dd663eba93be633882c6ac5f2c4e91e06050e35e62_amd64 as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:4219479d343e0889653411dd663eba93be633882c6ac5f2c4e91e06050e35e62_amd64 |
| Red Hat | registry.redhat.io/cluster-observability-operator/obo-prometheus-rhel8-operator@sha256:9ea465202c417bcef049bc5f585f9804d51a09066ebe9bbc38bbaae3dc071cad_ppc64le as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:10e2cc68db50f7018d14a28dcefa844fc67a3893c0ca665dfa7c53838c9d8515_amd64 as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-0-3-rhel9@sha256:10e2cc68db50f7018d14a28dcefa844fc67a3893c0ca665dfa7c53838c9d8515_amd64 |
| Red Hat | registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:47d961fc88adbc2b0cd49cca5215632f31bcc023ccc223147492d6de78f3c51f_ppc64le as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/cluster-observability-rhel8-operator@sha256:47d961fc88adbc2b0cd49cca5215632f31bcc023ccc223147492d6de78f3c51f_ppc64le |
| Red Hat | registry.redhat.io/cluster-observability-operator/thanos-rhel8@sha256:55676e8344b7792bb34e8a597ea4e5ce4bcb59f59c31623feacd9c698ea9d772_arm64 as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel8@sha256:55fea29b9fc172be497828aa7dc1c03f258b2a1fbed845d487ab97abe2a82495_s390x as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/obo-prometheus-operator-prometheus-config-reloader-rhel8@sha256:1546598bfe9c26a39ee752b8e488c67f4c711cba367d57d48554e660516835ad_arm64 as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/troubleshooting-panel-console-plugin-0-3-rhel9@sha256:0c2ca7da24745cfaaf991a10c37433065e928ca0ee0be35409c4ee70ecd286a8_arm64 as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/prometheus-rhel8@sha256:9febceb8da3ec2c129f18ce3be8015b167efdab11f58c1213236487471bfdd17_arm64 as a component of Cluster Observability Operator 1.0.0 | *, * |
| Red Hat | registry.redhat.io/cluster-observability-operator/korrel8r-rhel8@sha256:857195f1a5ac1b142ceaa62eef963340eb8438b0d160aa4d5d3ac04975fcee60_arm64 as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/korrel8r-rhel8@sha256:857195f1a5ac1b142ceaa62eef963340eb8438b0d160aa4d5d3ac04975fcee60_arm64 |
| Red Hat | registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:ebe029f66906c1af08cedebf6f3b785f05c72742b95d7fa3d0596835dcc69894_arm64 as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/alertmanager-rhel8@sha256:ebe029f66906c1af08cedebf6f3b785f05c72742b95d7fa3d0596835dcc69894_arm64 |
| Red Hat | registry.redhat.io/cluster-observability-operator/thanos-rhel8@sha256:38710d770f39ced208ab080bb8557a211bd46c48345e6bca794bd704884c7ffb_amd64 as a component of Cluster Observability Operator 1.0.0 | registry.redhat.io/cluster-observability-operator/thanos-rhel8@sha256:38710d770f39ced208ab080bb8557a211bd46c48345e6bca794bd704884c7ffb_amd64 |
…and 87 more
Timeline
- Feb 17, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 5, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1609 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://docs.openshift.com/container-platform/4.17/observability/cluster_observability_operator/cluster-observability-operator-release-notes.html advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://access.redhat.com/security/cve/CVE-2024-28849 advisory
- https://access.redhat.com/security/cve/CVE-2023-26159 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1609.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2256413 issue
- https://www.cve.org/CVERecord?id=CVE-2023-26159 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-26159 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2269576 issue
- https://www.cve.org/CVERecord?id=CVE-2024-28849 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-28849 advisory
- https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://go.dev/issue/70906 advisory
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
…and 1 more