VDB
RHSA-2025%3A4810
RHSA-2025%3A4810
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/subctl-rhel9@sha256:276b6bfc9a9fd9fbe04bf6f57c8f07eb66f43ab587acdd351d519b503b6e4aa1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/subctl-rhel9@sha256:276b6bfc9a9fd9fbe04bf6f57c8f07eb66f43ab587acdd351d519b503b6e4aa1_ppc64le, * |
| Red Hat | rhacm2/submariner-rhel9-operator@sha256:9d3dfd05f7eea812e4e6cfb0fb69c3c6b869dd372af4eaa24c7c794c8a896a04_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/submariner-rhel9-operator@sha256:9d3dfd05f7eea812e4e6cfb0fb69c3c6b869dd372af4eaa24c7c794c8a896a04_ppc64le, rhacm2/submariner-rhel9-operator@sha256:9d3dfd05f7eea812e4e6cfb0fb69c3c6b869dd372af4eaa24c7c794c8a896a04_ppc64le |
| Red Hat | rhacm2/subctl-rhel9@sha256:3b2bd11ed4fa07acd850b31e58e44576fc18a15f051d0ab87bfeca27429d00fb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:8d74068d66452a5670ee261bd750965a2e866a85fb6910cad3da73caa4fa3db7_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, *, * |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:cd0ef43fabb276b20e4984c0b0872a71e2895ce0c10c5cc02648237297429884_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-gateway-rhel9@sha256:cd0ef43fabb276b20e4984c0b0872a71e2895ce0c10c5cc02648237297429884_amd64, rhacm2/submariner-gateway-rhel9@sha256:cd0ef43fabb276b20e4984c0b0872a71e2895ce0c10c5cc02648237297429884_amd64, rhacm2/submariner-gateway-rhel9@sha256:cd0ef43fabb276b20e4984c0b0872a71e2895ce0c10c5cc02648237297429884_amd64 |
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:8d74068d66452a5670ee261bd750965a2e866a85fb6910cad3da73caa4fa3db7_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-globalnet-rhel9@sha256:8d74068d66452a5670ee261bd750965a2e866a85fb6910cad3da73caa4fa3db7_ppc64le, rhacm2/submariner-globalnet-rhel9@sha256:8d74068d66452a5670ee261bd750965a2e866a85fb6910cad3da73caa4fa3db7_ppc64le, rhacm2/submariner-globalnet-rhel9@sha256:8d74068d66452a5670ee261bd750965a2e866a85fb6910cad3da73caa4fa3db7_ppc64le |
| Red Hat | rhacm2/subctl-rhel9@sha256:02ca4183da204f63a74c592e51c5515afddd3a995b7016689ab84e3cca35eee7_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, *, rhacm2/subctl-rhel9@sha256:02ca4183da204f63a74c592e51c5515afddd3a995b7016689ab84e3cca35eee7_s390x |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:1736510c77d31f44c41a6296247c23ed6233edd24d34e0bce154294491f4be3d_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-gateway-rhel9@sha256:1736510c77d31f44c41a6296247c23ed6233edd24d34e0bce154294491f4be3d_ppc64le, rhacm2/submariner-gateway-rhel9@sha256:1736510c77d31f44c41a6296247c23ed6233edd24d34e0bce154294491f4be3d_ppc64le, rhacm2/submariner-gateway-rhel9@sha256:1736510c77d31f44c41a6296247c23ed6233edd24d34e0bce154294491f4be3d_ppc64le |
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:68d4c8d48073e15519ea25ea149f13cbfeb4513ca2cfc115108195d30847ee54_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-globalnet-rhel9@sha256:68d4c8d48073e15519ea25ea149f13cbfeb4513ca2cfc115108195d30847ee54_amd64, *, * |
| Red Hat | rhacm2/nettest-rhel9@sha256:febf756fb1e4b5d794dfc65be682a84bfae872cbcf897f46b3dd45061d1fd4f1_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/nettest-rhel9@sha256:febf756fb1e4b5d794dfc65be682a84bfae872cbcf897f46b3dd45061d1fd4f1_s390x, rhacm2/nettest-rhel9@sha256:febf756fb1e4b5d794dfc65be682a84bfae872cbcf897f46b3dd45061d1fd4f1_s390x, * |
| Red Hat | rhacm2/subctl-rhel9@sha256:276b6bfc9a9fd9fbe04bf6f57c8f07eb66f43ab587acdd351d519b503b6e4aa1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/subctl-rhel9@sha256:276b6bfc9a9fd9fbe04bf6f57c8f07eb66f43ab587acdd351d519b503b6e4aa1_ppc64le, rhacm2/subctl-rhel9@sha256:276b6bfc9a9fd9fbe04bf6f57c8f07eb66f43ab587acdd351d519b503b6e4aa1_ppc64le, rhacm2/subctl-rhel9@sha256:276b6bfc9a9fd9fbe04bf6f57c8f07eb66f43ab587acdd351d519b503b6e4aa1_ppc64le |
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:288dde5c26721a63b3d7db538f9f13e0672fdc01d7d2d0d28ba8495ddc855f26_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-globalnet-rhel9@sha256:288dde5c26721a63b3d7db538f9f13e0672fdc01d7d2d0d28ba8495ddc855f26_arm64, *, rhacm2/submariner-globalnet-rhel9@sha256:288dde5c26721a63b3d7db538f9f13e0672fdc01d7d2d0d28ba8495ddc855f26_arm64 |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:a049449a67ee5c9d4fee19b7dafc087f3647438a8ebfc94afd13409817f7ae11_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-gateway-rhel9@sha256:a049449a67ee5c9d4fee19b7dafc087f3647438a8ebfc94afd13409817f7ae11_s390x, rhacm2/submariner-gateway-rhel9@sha256:a049449a67ee5c9d4fee19b7dafc087f3647438a8ebfc94afd13409817f7ae11_s390x, rhacm2/submariner-gateway-rhel9@sha256:a049449a67ee5c9d4fee19b7dafc087f3647438a8ebfc94afd13409817f7ae11_s390x |
| Red Hat | rhacm2/nettest-rhel9@sha256:3fbf280a51d788d1e861aa72231bc63142aab2db08e2d358b68f10af1926d76d_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/nettest-rhel9@sha256:3fbf280a51d788d1e861aa72231bc63142aab2db08e2d358b68f10af1926d76d_arm64, *, rhacm2/nettest-rhel9@sha256:3fbf280a51d788d1e861aa72231bc63142aab2db08e2d358b68f10af1926d76d_arm64 |
| Red Hat | rhacm2/submariner-rhel9-operator@sha256:1166829081e0697db0ff7b348e9b96cbe63a9382d7534e6ab093527e91b87fe2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-rhel9-operator@sha256:1166829081e0697db0ff7b348e9b96cbe63a9382d7534e6ab093527e91b87fe2_amd64, rhacm2/submariner-rhel9-operator@sha256:1166829081e0697db0ff7b348e9b96cbe63a9382d7534e6ab093527e91b87fe2_amd64, rhacm2/submariner-rhel9-operator@sha256:1166829081e0697db0ff7b348e9b96cbe63a9382d7534e6ab093527e91b87fe2_amd64 |
| Red Hat | rhacm2/submariner-globalnet-rhel9@sha256:8ae3f309e90f4e96fa43cb402604c3a592befe53278194645b3161425d385b95_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-globalnet-rhel9@sha256:8ae3f309e90f4e96fa43cb402604c3a592befe53278194645b3161425d385b95_s390x, rhacm2/submariner-globalnet-rhel9@sha256:8ae3f309e90f4e96fa43cb402604c3a592befe53278194645b3161425d385b95_s390x, rhacm2/submariner-globalnet-rhel9@sha256:8ae3f309e90f4e96fa43cb402604c3a592befe53278194645b3161425d385b95_s390x |
| Red Hat | rhacm2/submariner-gateway-rhel9@sha256:d1c68df738f63ecdedcfa31105bd542b70652bbc5e380d371fbfd2f2b07147f5_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/submariner-gateway-rhel9@sha256:d1c68df738f63ecdedcfa31105bd542b70652bbc5e380d371fbfd2f2b07147f5_arm64, rhacm2/submariner-gateway-rhel9@sha256:d1c68df738f63ecdedcfa31105bd542b70652bbc5e380d371fbfd2f2b07147f5_arm64, rhacm2/submariner-gateway-rhel9@sha256:d1c68df738f63ecdedcfa31105bd542b70652bbc5e380d371fbfd2f2b07147f5_arm64 |
| Red Hat | rhacm2/subctl-rhel9@sha256:3b2bd11ed4fa07acd850b31e58e44576fc18a15f051d0ab87bfeca27429d00fb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/subctl-rhel9@sha256:3b2bd11ed4fa07acd850b31e58e44576fc18a15f051d0ab87bfeca27429d00fb_amd64, rhacm2/subctl-rhel9@sha256:3b2bd11ed4fa07acd850b31e58e44576fc18a15f051d0ab87bfeca27429d00fb_amd64 |
| Red Hat | rhacm2/lighthouse-coredns-rhel9@sha256:aca3e04ec4d68baadb49ee2a7f08855f6ef723b020555e8fb098ceedf81e97df_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | rhacm2/lighthouse-coredns-rhel9@sha256:aca3e04ec4d68baadb49ee2a7f08855f6ef723b020555e8fb098ceedf81e97df_ppc64le, *, rhacm2/lighthouse-coredns-rhel9@sha256:aca3e04ec4d68baadb49ee2a7f08855f6ef723b020555e8fb098ceedf81e97df_ppc64le |
| Red Hat | rhacm2/submariner-route-agent-rhel9@sha256:f5b723ae4deed730a1def563565cc0bb0a04e8fa59d2417aa974f8ef473f1380_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | *, rhacm2/submariner-route-agent-rhel9@sha256:f5b723ae4deed730a1def563565cc0bb0a04e8fa59d2417aa974f8ef473f1380_amd64, rhacm2/submariner-route-agent-rhel9@sha256:f5b723ae4deed730a1def563565cc0bb0a04e8fa59d2417aa974f8ef473f1380_amd64 |
…and 53 more
Timeline
- May 12, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:4810 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2329991 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2354195 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_4810.json advisory
- https://access.redhat.com/security/cve/CVE-2024-45336 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
- https://github.com/golang/go/issues/70530 advisory
- https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI advisory
- https://access.redhat.com/security/cve/CVE-2024-53259 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-53259 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-53259 advisory
- https://github.com/quic-go/quic-go/commit/ca31dd355cbe5fc6c5807992d9d1149c66c96a50 advisory
- https://github.com/quic-go/quic-go/pull/4729 advisory
- https://github.com/quic-go/quic-go/releases/tag/v0.48.2 advisory
- https://github.com/quic-go/quic-go/security/advisories/GHSA-px8v-pp82-rcvr advisory
…and 19 more