Bug 2268018 (CVE-2023-45289)
| Summary: | CVE-2023-45289 golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Robb Gatica <rgatica> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alcohan, amctagga, anjoseph, ansmith, aoconnor, bdettelb, bniver, chazlett, crizzo, dfreiber, dhanak, dkenigsb, doconnor, dperaza, drow, dsimansk, dymurray, eglynn, fdeutsch, flucifre, gmeno, gparvin, ibolton, jaharrin, jburrell, jcantril, jchui, jeder, jjoyce, jmatthew, jmontleo, joelsmith, jprabhak, jschluet, kingland, kverlaen, lbainbri, lchilton, lhh, lsvaty, manissin, matzew, mbenjamin, mburns, mgarciac, mhackett, mmilev, mnovotny, mwringe, njean, oramraz, owatkins, pahickey, peholase, pgaikwad, pgrist, pierdipi, pjindal, rguimara, rhaigner, rhuss, rjohnson, rojacob, saroy, sausingh, sdawley, sfeifer, shbose, sidakwo, sipoyare, slucidi, smullick, sostapov, sseago, stirabos, teagle, thason, vereddy, vkumar, whayutin, wtam |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | go 1.21.8, go 1.22.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Go's net/http/cookiejar standard library package. When following an HTTP redirect to a domain that is not a subdomain match or an exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2268242, 2268243, 2276431, 2276432, 2276433, 2276434, 2276435, 2276436, 2292178, 2292179 | ||
| Bug Blocks: | 2268016 | ||
|
Description
Robb Gatica
2024-03-06 01:53:52 UTC
Created golang tracking bugs for this issue: Affects: epel-all [bug 2268243] Affects: fedora-all [bug 2268242] This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2562 https://access.redhat.com/errata/RHSA-2024:2562 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:2724 https://access.redhat.com/errata/RHSA-2024:2724 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3259 https://access.redhat.com/errata/RHSA-2024:3259 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3346 https://access.redhat.com/errata/RHSA-2024:3346 This issue has been addressed in the following products: Red Hat Openshift distributed tracing 3.2 Via RHSA-2024:3621 https://access.redhat.com/errata/RHSA-2024:3621 This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2024:3790 https://access.redhat.com/errata/RHSA-2024:3790 This issue has been addressed in the following products: NETWORK-OBSERVABILITY-1.6.0-RHEL-9 Via RHSA-2024:3868 https://access.redhat.com/errata/RHSA-2024:3868 This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2024:4023 https://access.redhat.com/errata/RHSA-2024:4023 This issue has been addressed in the following products: RHOSS-1.33-RHEL-8 Via RHSA-2024:4028 https://access.redhat.com/errata/RHSA-2024:4028 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:0041 https://access.redhat.com/errata/RHSA-2024:0041 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:0045 https://access.redhat.com/errata/RHSA-2024:0045 This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.8 Via RHSA-2024:7164 https://access.redhat.com/errata/RHSA-2024:7164 This issue has been addressed in the following products: Red Hat OpenStack Services on OpenShift PODIFIED 1.0 Via RHSA-2024:9485 https://access.redhat.com/errata/RHSA-2024:9485 |