VDB
RHSA-2025%3A2789
RHSA-2025%3A2789
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:12407a15fefa30bb851444d27b00e1815970ae085deca7c17537612ec9e4bff6_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:12407a15fefa30bb851444d27b00e1815970ae085deca7c17537612ec9e4bff6_arm64, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:ffd6b70068dd4d6bf7a835c0bbf5b934f26ff2b0f5755130dccb099340550083_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.1 | *, *, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:ffd6b70068dd4d6bf7a835c0bbf5b934f26ff2b0f5755130dccb099340550083_ppc64le |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:bf3aa3e5522cf90d82fbd34710e08448a93b88a9876c77415a1027f83a195a81_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:7e0320614f3be4e8bb1442d5890d2a6cebaf0a1038599d6afbf50daca91e1d65_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:7e0320614f3be4e8bb1442d5890d2a6cebaf0a1038599d6afbf50daca91e1d65_arm64 |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:e2375ae72ddda9e05e66972adb7bf953bfbf220dcc8b36d6eb1ab76d9e96ff5d_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:bf3aa3e5522cf90d82fbd34710e08448a93b88a9876c77415a1027f83a195a81_arm64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:bf3aa3e5522cf90d82fbd34710e08448a93b88a9876c77415a1027f83a195a81_arm64, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f9ec6952abc11519409299f0dfffae3b520395cc122d1f2cd375d65492c6aed7_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f9ec6952abc11519409299f0dfffae3b520395cc122d1f2cd375d65492c6aed7_amd64, *, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:e3f56102b0cf46e862fc1e015516c5364e49d02cd6ca112b72b1fa3287a96a2d_s390x as a component of Red Hat OpenShift distributed tracing 3.5.1 | *, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:e3f56102b0cf46e862fc1e015516c5364e49d02cd6ca112b72b1fa3287a96a2d_s390x, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:e3f56102b0cf46e862fc1e015516c5364e49d02cd6ca112b72b1fa3287a96a2d_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:adb1f41e544331b0936c6591edb00c169a9e5a2592c12f6ee55aaab8786ff5ba_s390x as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:adb1f41e544331b0936c6591edb00c169a9e5a2592c12f6ee55aaab8786ff5ba_s390x, *, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:adb1f41e544331b0936c6591edb00c169a9e5a2592c12f6ee55aaab8786ff5ba_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:f9ec6952abc11519409299f0dfffae3b520395cc122d1f2cd375d65492c6aed7_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:8b7455c14f26b80006568829343688b50ad1c563d339c35f70eb7d561499bc1c_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.1 | *, registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:8b7455c14f26b80006568829343688b50ad1c563d339c35f70eb7d561499bc1c_ppc64le, registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:8b7455c14f26b80006568829343688b50ad1c563d339c35f70eb7d561499bc1c_ppc64le |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:0742729985d0b1ce925bdaaa92c2bb42272902f4c2e93038c0fcf171c7baf03f_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8_s390x as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:cced4191c3e84f44eca2ed486592c473f97fd5cd0941edb9d216051802dad3f7_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:cced4191c3e84f44eca2ed486592c473f97fd5cd0941edb9d216051802dad3f7_ppc64le |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:d23b9c8d0266de7ce5427d125b2749053d2e4b44d632e3eb484775a5eede41b0_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:d23b9c8d0266de7ce5427d125b2749053d2e4b44d632e3eb484775a5eede41b0_amd64, registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:d23b9c8d0266de7ce5427d125b2749053d2e4b44d632e3eb484775a5eede41b0_amd64, * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:adb1f41e544331b0936c6591edb00c169a9e5a2592c12f6ee55aaab8786ff5ba_s390x as a component of Red Hat OpenShift distributed tracing 3.5.1 | * |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8_s390x as a component of Red Hat OpenShift distributed tracing 3.5.1 | *, registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8_s390x, registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:92613ae031dd45d85151ff1bd0703ee6bbc6842133cdc51b274769122ea40ac8_s390x |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:d23b9c8d0266de7ce5427d125b2749053d2e4b44d632e3eb484775a5eede41b0_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:d23b9c8d0266de7ce5427d125b2749053d2e4b44d632e3eb484775a5eede41b0_amd64 |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:ffd6b70068dd4d6bf7a835c0bbf5b934f26ff2b0f5755130dccb099340550083_ppc64le as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:ffd6b70068dd4d6bf7a835c0bbf5b934f26ff2b0f5755130dccb099340550083_ppc64le |
| Red Hat | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:0742729985d0b1ce925bdaaa92c2bb42272902f4c2e93038c0fcf171c7baf03f_amd64 as a component of Red Hat OpenShift distributed tracing 3.5.1 | registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:0742729985d0b1ce925bdaaa92c2bb42272902f4c2e93038c0fcf171c7baf03f_amd64, *, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:0742729985d0b1ce925bdaaa92c2bb42272902f4c2e93038c0fcf171c7baf03f_amd64 |
…and 6 more
Timeline
- Mar 13, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 15, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:2789 advisory
- https://access.redhat.com/security/cve/CVE-2024-45336 advisory
- https://access.redhat.com/security/cve/CVE-2024-56171 advisory
- https://access.redhat.com/security/cve/CVE-2025-22866 advisory
- https://access.redhat.com/security/cve/CVE-2025-24528 advisory
- https://access.redhat.com/security/cve/CVE-2025-24928 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2789.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
- https://github.com/golang/go/issues/70530 advisory
- https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2346416 issue
- https://www.cve.org/CVERecord?id=CVE-2024-56171 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-56171 advisory
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/828 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
- https://www.cve.org/CVERecord?id=CVE-2025-22866 advisory
…and 14 more