VDB
RHSA-2025%3A21704
RHSA-2025%3A21704
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in follow-redirects when fetching a remote URL with a cookie when it gets to the Location response header. This flaw allows an attacker to hijack the account as the cookie is leaked.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:c7d1fd337adb3a89005b172e62c54d1dcb48498a7687eb790fbdc1c65764e40b_s390x as a component of Red Hat Openshift Data Foundation 4.2 | *, *, registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:c7d1fd337adb3a89005b172e62c54d1dcb48498a7687eb790fbdc1c65764e40b_s390x |
| Red Hat | registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:6065f46be96a09ae81ffa461bfc3c2b08bbeefaaed5ce89beb7c3d2775c59fe2_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:6065f46be96a09ae81ffa461bfc3c2b08bbeefaaed5ce89beb7c3d2775c59fe2_ppc64le, *, * |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:8c82a478ebc0918907971653269363058257118c6734c6589bb7e13d00c9388f_s390x as a component of Red Hat Openshift Data Foundation 4.20 | * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:5d53d05682c689cafed5f0e705caf4713f457552f94cfa1ecd5f3302a7f8461b_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | *, *, registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:5d53d05682c689cafed5f0e705caf4713f457552f94cfa1ecd5f3302a7f8461b_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:43558293aaad9fd082778dfc1f51e0ce0f7bb8dc2e350cfc58bcabc0c5ab3b62_s390x as a component of Red Hat Openshift Data Foundation 4.20 | * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-operator-bundle@sha256:2ad872d68932818938fa8ac388b86879a979eb242758d9de48b7400b104c5668_amd64 as a component of Red Hat Openshift Data Foundation 4.20 | * |
| Red Hat | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:31ad9bb62727dc6c6b5d623e009dc60e2886716cd861c6785f314bf670f2a8a7_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:31ad9bb62727dc6c6b5d623e009dc60e2886716cd861c6785f314bf670f2a8a7_ppc64le, registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:31ad9bb62727dc6c6b5d623e009dc60e2886716cd861c6785f314bf670f2a8a7_ppc64le, * |
| Red Hat | registry.redhat.io/odf4/odf-cli-rhel9@sha256:58fc4b8a0f1d84f86547b13136c96a0f7bbb985161dee73702ed91da6a965693_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-cli-rhel9@sha256:58fc4b8a0f1d84f86547b13136c96a0f7bbb985161dee73702ed91da6a965693_ppc64le, registry.redhat.io/odf4/odf-cli-rhel9@sha256:58fc4b8a0f1d84f86547b13136c96a0f7bbb985161dee73702ed91da6a965693_ppc64le, registry.redhat.io/odf4/odf-cli-rhel9@sha256:58fc4b8a0f1d84f86547b13136c96a0f7bbb985161dee73702ed91da6a965693_ppc64le |
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:fb8c5faf2e866c02d0cb11e71430d95fe3ceab5f15ff2a82be2ee86d0a57de3c_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-rhel9-operator@sha256:fb8c5faf2e866c02d0cb11e71430d95fe3ceab5f15ff2a82be2ee86d0a57de3c_amd64, registry.redhat.io/odf4/odf-rhel9-operator@sha256:fb8c5faf2e866c02d0cb11e71430d95fe3ceab5f15ff2a82be2ee86d0a57de3c_amd64, registry.redhat.io/odf4/odf-rhel9-operator@sha256:fb8c5faf2e866c02d0cb11e71430d95fe3ceab5f15ff2a82be2ee86d0a57de3c_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-operator-bundle@sha256:bb0f29ced80a4d4fe1518bda27025e39e3da8c24fc6fb00c286dbb72e5d5d4d2_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-external-snapshotter-operator-bundle@sha256:bb0f29ced80a4d4fe1518bda27025e39e3da8c24fc6fb00c286dbb72e5d5d4d2_amd64, registry.redhat.io/odf4/odf-external-snapshotter-operator-bundle@sha256:bb0f29ced80a4d4fe1518bda27025e39e3da8c24fc6fb00c286dbb72e5d5d4d2_amd64, registry.redhat.io/odf4/odf-external-snapshotter-operator-bundle@sha256:bb0f29ced80a4d4fe1518bda27025e39e3da8c24fc6fb00c286dbb72e5d5d4d2_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:5f58bfa17b3524b4d639cf0f7af2e188cac2241475cb454720db33aff68fc209_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | *, registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:5f58bfa17b3524b4d639cf0f7af2e188cac2241475cb454720db33aff68fc209_amd64, * |
| Red Hat | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:694354fb3e2505c0b47c296d601b95f3a020df9a1e3f7e4b8ccf759b3073f57d_s390x as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:694354fb3e2505c0b47c296d601b95f3a020df9a1e3f7e4b8ccf759b3073f57d_s390x, *, registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:694354fb3e2505c0b47c296d601b95f3a020df9a1e3f7e4b8ccf759b3073f57d_s390x |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:a83892802fdc40708c3dffb7f3e13d6e6a6105679a0af15d04aa5626f2339b10_s390x as a component of Red Hat Openshift Data Foundation 4.20 | * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-operator-bundle@sha256:2ad872d68932818938fa8ac388b86879a979eb242758d9de48b7400b104c5668_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:b31a37b81859a431afe86d288ecc72f671e62b6aa1ce1f5f0cf2bed982b2b0dd_arm64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:b31a37b81859a431afe86d288ecc72f671e62b6aa1ce1f5f0cf2bed982b2b0dd_arm64, registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:b31a37b81859a431afe86d288ecc72f671e62b6aa1ce1f5f0cf2bed982b2b0dd_arm64, registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:b31a37b81859a431afe86d288ecc72f671e62b6aa1ce1f5f0cf2bed982b2b0dd_arm64 |
| Red Hat | registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:a3ac21943ff1a943aee289166e4bb0f56f9691f9301538c7f2f284b0f60c45fc_amd64 as a component of Red Hat Openshift Data Foundation 4.20 | * |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:5f58bfa17b3524b4d639cf0f7af2e188cac2241475cb454720db33aff68fc209_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | *, *, registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:5f58bfa17b3524b4d639cf0f7af2e188cac2241475cb454720db33aff68fc209_amd64 |
| Red Hat | registry.redhat.io/odf4/odf-cli-rhel9@sha256:bb98d3240a725a7d025baa6f39e9f14a9e9b781c23b2204fd34f914fd94fad16_arm64 as a component of Red Hat Openshift Data Foundation 4.20 | * |
| Red Hat | registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:a07d753741e8f635c03ff0fa83ae28a0f8b444678c92e109784bea549a840624_ppc64le as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:a07d753741e8f635c03ff0fa83ae28a0f8b444678c92e109784bea549a840624_ppc64le, registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:a07d753741e8f635c03ff0fa83ae28a0f8b444678c92e109784bea549a840624_ppc64le, registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:a07d753741e8f635c03ff0fa83ae28a0f8b444678c92e109784bea549a840624_ppc64le |
| Red Hat | registry.redhat.io/odf4/odf-console-rhel9@sha256:8439ea9b94e6ebe0038c0fa74914c26839532c716c5e25e5f525318be10ca67e_amd64 as a component of Red Hat Openshift Data Foundation 4.2 | registry.redhat.io/odf4/odf-console-rhel9@sha256:8439ea9b94e6ebe0038c0fa74914c26839532c716c5e25e5f525318be10ca67e_amd64, *, * |
…and 288 more
Timeline
- Nov 18, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jul 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:21704 advisory
- https://access.redhat.com/security/cve/CVE-2022-0155 advisory
- https://access.redhat.com/security/cve/CVE-2022-0536 advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://access.redhat.com/security/cve/CVE-2025-22869 advisory
- https://access.redhat.com/security/cve/CVE-2025-5889 advisory
- https://access.redhat.com/security/cve/CVE-2025-7339 advisory
- https://access.redhat.com/security/cve/CVE-2025-7783 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21704.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2044556 issue
- https://www.cve.org/CVERecord?id=CVE-2022-0155 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-0155 advisory
- https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2053259 issue
- https://www.cve.org/CVERecord?id=CVE-2022-0536 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-0536 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
…and 32 more