VDB
RHSA-2025%3A3131
RHSA-2025%3A3131
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/eventrouter-rhel9@sha256:7b986827ecb1f0014ced0cd8bcdf5db0b2522bd2743e7c76eddedf0846428070_amd64 as a component of RHOL 6.1 for RHEL 9 | openshift-logging/eventrouter-rhel9@sha256:7b986827ecb1f0014ced0cd8bcdf5db0b2522bd2743e7c76eddedf0846428070_amd64, openshift-logging/eventrouter-rhel9@sha256:7b986827ecb1f0014ced0cd8bcdf5db0b2522bd2743e7c76eddedf0846428070_amd64, openshift-logging/eventrouter-rhel9@sha256:7b986827ecb1f0014ced0cd8bcdf5db0b2522bd2743e7c76eddedf0846428070_amd64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:8ce642fc6ba84abec046ec4d37e6ae11b841978148d6548c972f93374ef11bec_s390x as a component of RHOL 6.1 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:8ce642fc6ba84abec046ec4d37e6ae11b841978148d6548c972f93374ef11bec_s390x, *, openshift-logging/lokistack-gateway-rhel9@sha256:8ce642fc6ba84abec046ec4d37e6ae11b841978148d6548c972f93374ef11bec_s390x |
| Red Hat | openshift-logging/cluster-logging-rhel9-operator@sha256:8027ebaf481eebf1d9b3d0eee35d0f8390ba0aecbc6e2ee06f88043c46340aa8_arm64 as a component of RHOL 6.1 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x as a component of RHOL 6.1 for RHEL 9 | openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x, openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x, openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:80a8d28b9a04a24139f8b3886c2ef6ab4f27bb6f14b3890f224f7d1ac6379472_amd64 as a component of RHOL 6.1 for RHEL 9 | openshift-logging/loki-rhel9-operator@sha256:80a8d28b9a04a24139f8b3886c2ef6ab4f27bb6f14b3890f224f7d1ac6379472_amd64, openshift-logging/loki-rhel9-operator@sha256:80a8d28b9a04a24139f8b3886c2ef6ab4f27bb6f14b3890f224f7d1ac6379472_amd64, openshift-logging/loki-rhel9-operator@sha256:80a8d28b9a04a24139f8b3886c2ef6ab4f27bb6f14b3890f224f7d1ac6379472_amd64 |
| Red Hat | openshift-logging/logging-loki-rhel9@sha256:af9aa36d2fdf2ca882bac401ac5caff5241b1ae42c1fff0f8cffcd3e8a00a6f2_amd64 as a component of RHOL 6.1 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/vector-rhel9@sha256:0e1f8896fe6abb6f8d6961b4a390205e001877e7621c78f305e08c7d97235f5e_ppc64le as a component of RHOL 6.1 for RHEL 9 | openshift-logging/vector-rhel9@sha256:0e1f8896fe6abb6f8d6961b4a390205e001877e7621c78f305e08c7d97235f5e_ppc64le, openshift-logging/vector-rhel9@sha256:0e1f8896fe6abb6f8d6961b4a390205e001877e7621c78f305e08c7d97235f5e_ppc64le, openshift-logging/vector-rhel9@sha256:0e1f8896fe6abb6f8d6961b4a390205e001877e7621c78f305e08c7d97235f5e_ppc64le |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:83bcc8176e1171bbbcca67f26c31a9c991dc706f7ed44c1618cb82187414054f_arm64 as a component of RHOL 6.1 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:83bcc8176e1171bbbcca67f26c31a9c991dc706f7ed44c1618cb82187414054f_arm64, openshift-logging/lokistack-gateway-rhel9@sha256:83bcc8176e1171bbbcca67f26c31a9c991dc706f7ed44c1618cb82187414054f_arm64, openshift-logging/lokistack-gateway-rhel9@sha256:83bcc8176e1171bbbcca67f26c31a9c991dc706f7ed44c1618cb82187414054f_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:d33dabeb04dc31d194efcec83667928a33481d7bf7086365b9672c1cd150faa3_amd64 as a component of RHOL 6.1 for RHEL 9 | openshift-logging/lokistack-gateway-rhel9@sha256:d33dabeb04dc31d194efcec83667928a33481d7bf7086365b9672c1cd150faa3_amd64, openshift-logging/lokistack-gateway-rhel9@sha256:d33dabeb04dc31d194efcec83667928a33481d7bf7086365b9672c1cd150faa3_amd64, openshift-logging/lokistack-gateway-rhel9@sha256:d33dabeb04dc31d194efcec83667928a33481d7bf7086365b9672c1cd150faa3_amd64 |
| Red Hat | openshift-logging/cluster-logging-rhel9-operator@sha256:fafc296b1270eb068157cccb039599c1159cab5e149b45acf0da57e3a04e7b36_s390x as a component of RHOL 6.1 for RHEL 9 | openshift-logging/cluster-logging-rhel9-operator@sha256:fafc296b1270eb068157cccb039599c1159cab5e149b45acf0da57e3a04e7b36_s390x, openshift-logging/cluster-logging-rhel9-operator@sha256:fafc296b1270eb068157cccb039599c1159cab5e149b45acf0da57e3a04e7b36_s390x, * |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:80a8d28b9a04a24139f8b3886c2ef6ab4f27bb6f14b3890f224f7d1ac6379472_amd64 as a component of RHOL 6.1 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/log-file-metric-exporter-rhel9@sha256:a4511102e85d0f6bd2197429d782e47a856024082bf819ba51a9f3dd1106c151_arm64 as a component of RHOL 6.1 for RHEL 9 | openshift-logging/log-file-metric-exporter-rhel9@sha256:a4511102e85d0f6bd2197429d782e47a856024082bf819ba51a9f3dd1106c151_arm64, *, * |
| Red Hat | openshift-logging/lokistack-gateway-rhel9@sha256:83bcc8176e1171bbbcca67f26c31a9c991dc706f7ed44c1618cb82187414054f_arm64 as a component of RHOL 6.1 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/cluster-logging-operator-bundle@sha256:2ac22e0a4469dbd521e501f94aed9d6f6cfd42c380295fccda70845e624cc344_amd64 as a component of RHOL 6.1 for RHEL 9 | openshift-logging/cluster-logging-operator-bundle@sha256:2ac22e0a4469dbd521e501f94aed9d6f6cfd42c380295fccda70845e624cc344_amd64, *, openshift-logging/cluster-logging-operator-bundle@sha256:2ac22e0a4469dbd521e501f94aed9d6f6cfd42c380295fccda70845e624cc344_amd64 |
| Red Hat | openshift-logging/vector-rhel9@sha256:cccff902663f34e08ae0bd837bd518fa35fa6a91f822b354923e089bd5a24b53_amd64 as a component of RHOL 6.1 for RHEL 9 | *, *, openshift-logging/vector-rhel9@sha256:cccff902663f34e08ae0bd837bd518fa35fa6a91f822b354923e089bd5a24b53_amd64 |
| Red Hat | openshift-logging/eventrouter-rhel9@sha256:63d9b83da2752c6fa9a4764afca3e98b82265d0157714eb0e8f4d31351d135f5_ppc64le as a component of RHOL 6.1 for RHEL 9 | openshift-logging/eventrouter-rhel9@sha256:63d9b83da2752c6fa9a4764afca3e98b82265d0157714eb0e8f4d31351d135f5_ppc64le, openshift-logging/eventrouter-rhel9@sha256:63d9b83da2752c6fa9a4764afca3e98b82265d0157714eb0e8f4d31351d135f5_ppc64le, openshift-logging/eventrouter-rhel9@sha256:63d9b83da2752c6fa9a4764afca3e98b82265d0157714eb0e8f4d31351d135f5_ppc64le |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:cd655287a3a3dd0540e36df230c0c2cdeabbc8d61a6be64c70bb515da9ff0a3f_s390x as a component of RHOL 6.1 for RHEL 9 | openshift-logging/loki-rhel9-operator@sha256:cd655287a3a3dd0540e36df230c0c2cdeabbc8d61a6be64c70bb515da9ff0a3f_s390x, openshift-logging/loki-rhel9-operator@sha256:cd655287a3a3dd0540e36df230c0c2cdeabbc8d61a6be64c70bb515da9ff0a3f_s390x, openshift-logging/loki-rhel9-operator@sha256:cd655287a3a3dd0540e36df230c0c2cdeabbc8d61a6be64c70bb515da9ff0a3f_s390x |
| Red Hat | openshift-logging/cluster-logging-rhel9-operator@sha256:fafc296b1270eb068157cccb039599c1159cab5e149b45acf0da57e3a04e7b36_s390x as a component of RHOL 6.1 for RHEL 9 | *, *, * |
| Red Hat | openshift-logging/loki-rhel9-operator@sha256:1a0ec1a067b407ba7e48e4aeadb0c9a087e0baa0cb36c23361ac65d16426f10c_ppc64le as a component of RHOL 6.1 for RHEL 9 | openshift-logging/loki-rhel9-operator@sha256:1a0ec1a067b407ba7e48e4aeadb0c9a087e0baa0cb36c23361ac65d16426f10c_ppc64le, openshift-logging/loki-rhel9-operator@sha256:1a0ec1a067b407ba7e48e4aeadb0c9a087e0baa0cb36c23361ac65d16426f10c_ppc64le, openshift-logging/loki-rhel9-operator@sha256:1a0ec1a067b407ba7e48e4aeadb0c9a087e0baa0cb36c23361ac65d16426f10c_ppc64le |
| Red Hat | openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x as a component of RHOL 6.1 for RHEL 9 | openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x, openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x, openshift-logging/opa-openshift-rhel9@sha256:c19b42a324d049b71a09f3979b8718220166279ae4f135dc339813d15e2082f6_s390x |
…and 49 more
Timeline
- Mar 26, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jul 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:3131 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2333122 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2347423 issue
- https://issues.redhat.com/browse/LOG-6623 advisory
- https://issues.redhat.com/browse/LOG-6797 advisory
- https://issues.redhat.com/browse/LOG-6816 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3131.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45336 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
- https://github.com/golang/go/issues/70530 advisory
- https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://go.dev/cl/637536 advisory
- https://go.dev/issue/70906 advisory
- https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ advisory
…and 7 more