En resumen
- CVE-2024-45336 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a stdlib.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.73%, mayor que el 54.1% de las vulnerabilidades.
- Solución: actualizar a 1.23.5, 1.24.0-rc.2, 1.22.11 o posterior.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.23.0-0, < 1.23.5≥ 1.24.0-0, < 1.24.0-rc.2< 1.22.11
| 1.23.51.24.0-rc.21.22.11
|
Description
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.
In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
NVD description
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free