En bref
- CVE-2024-45336 est une vulnérabilité MOYENNE (CVSS 6.1) touchant stdlib.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.73%, plus élevée que 54.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.23.5, 1.24.0-rc.2, 1.22.11 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.23.0-0, < 1.23.5≥ 1.24.0-0, < 1.24.0-rc.2< 1.22.11
| 1.23.51.24.0-rc.21.22.11
|
Description
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com.
In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
NVD description
The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free