Skip to content
Fencer Vulns
medium 4.3

CVE-2023-45289 json

Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

published 2024-03-05 2 y ago modified 2026-06-17 4 mo ago also BIT-golang-2023-45289 , EUVD-2023-49588 , GO-2024-2600

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

Patch / fix

  • bitnami golang 1.21.8, 1.22.1
  • go stdlib 1.21.8, 1.22.1
  • Go standard library net/http 1.21.8, 1.22.1
  • Go standard library net/http/cookiejar 1.21.8, 1.22.1
  • golang-1.21 Ubuntu 20.04 LTS 1.21.1-1~ubuntu20.04.3
  • golang-1.21 Ubuntu 22.04 LTS 1.21.1-1~ubuntu22.04.3

ubuntu advisories UBUNTU-CVE-2023-45289

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • delve RHEL 8 1.21.2-3.module+el8.10.0+21244+5b2d9000
  • golang RHEL 8 1.21.9-1.module+el8.10.0+21671+b35c3b78
  • go-toolset RHEL 8 1.21.9-1.module+el8.10.0+21671+b35c3b78
  • golang-bin RHEL 8 1.21.9-1.module+el8.10.0+21671+b35c3b78
  • golang-src RHEL 8 1.21.9-1.module+el8.10.0+21671+b35c3b78
  • golang-misc RHEL 8 1.21.9-1.module+el8.10.0+21671+b35c3b78
  • golang-tests RHEL 8 1.21.9-1.module+el8.10.0+21671+b35c3b78
  • openshift-serverless-clients serverless 1.0 1.12.0-7.el8

red hat advisories RHSA-2024:3259RHSA-2024:4023RHSA-2024:0045RHSA-2024:3346RHSA-2024:2724RHSA-2024:2562

  • golang-github-prometheus-prometheus SLE Module for Package Hub 15 SP7 3.13.2-150100.4.40.2
  • grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
  • mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
  • spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
  • uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
  • venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1
  • spacewalk-client-tools Multi Linux Manager Tools SLE-15 5.2.7-150002.3.12.1
  • golang-github-prometheus-prometheus Multi Linux Manager Tools SLE-15 3.13.2-150002.3.19.1

suse advisories SUSE-SU-2026:4606-1SUSE-SU-2026:4585-1SUSE-SU-2024:3938-1SUSE-SU-2024:3772-1SUSE-SU-2024:3755-1SUSE-SU-2024:3089-1

  • golang-github-prometheus-prometheus openSUSE Tumbleweed 3.13.2-1.1
  • go1.22 openSUSE Tumbleweed 1.22.1-1.1
  • go1.21 openSUSE Tumbleweed 1.21.8-1.1

opensuse advisories openSUSE-SU-2026:11436-1openSUSE-SU-2024:13752-1openSUSE-SU-2024:13756-1

  • git-lfs AlmaLinux 8 3.4.1-2.el8_10
  • delve AlmaLinux 8 1.21.2-3.module_el8.10.0+3760+4dd778f9
  • golang AlmaLinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3
  • go-toolset AlmaLinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3
  • golang-bin AlmaLinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3
  • golang-src AlmaLinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3
  • golang-misc AlmaLinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3
  • golang-tests AlmaLinux 8 1.21.9-1.module_el8.10.0+3840+edaca3c3

almalinux advisories ALSA-2024:3346ALSA-2024:3259ALSA-2024:2724ALSA-2024:2562

  • delve Rocky Linux 8 1.21.2-3.module+el8.10.0+1814+f68f8a63
  • golang Rocky Linux 8 1.21.9-1.module+el8.10.0+1814+f68f8a63
  • go-toolset Rocky Linux 8 1.21.9-1.module+el8.10.0+1814+f68f8a63
  • git-lfs Rocky Linux 8 3.4.1-2.el8_10
  • golang Rocky Linux 9 1.21.9-2.el9_4
  • git-lfs Rocky Linux 9 3.4.1-2.el9_4

rocky linux advisories RLSA-2024:3259RLSA-2024:3346RLSA-2024:2562RLSA-2024:2724

  • go Alpine 3.19 1.21.8-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.22.1-r0

alpine advisories ALPINE-CVE-2023-45289

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-37462AZL-37473

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45289 updated cvss 5.3

golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect

  • Red Hat Builds for Red Hat OpenShift openshift-builds-triggers-container Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services helm Red Hat OpenShift Pipelines openshift-pipelines-client
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 7 rhceph/grafana-rhel9
    affected: workaround, no fix available
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +12 more Red Hat Enterprise Linux 9 grafana, grafana-selinux, osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8
    affected: workaround, no fix available
show 19 more
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8 Red Hat OpenShift on AWS rosa
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-podvm-payload-rhel9 Red Hat OpenShift Virtualization 4 openshift-golang-builder-container Red Hat Quay 3 quay/clair-rhel8
    affected: workaround, no fix available
  • Red Hat Service Interconnect 1 skupper-cli skupper-cli
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Migration Toolkit for Virtualization 2.6 migration-toolkit-virtualization/mtv-api-rhel9 2.6.2-9, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 2.6.2-9, migration-toolkit-virtualization/mtv-rhel8-operator 2.6.2-11, migration-toolkit-virtualization/mtv-controller-rhel9 2.6.2-9, migration-toolkit-virtualization/mtv-operator-bundle 2.6.2-26, migration-toolkit-virtualization/mtv-validation-rhel9 2.6.2-9, +7 more
    fixed: vendor fix RHBA-2024:3470
  • Red Hat NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.6.0-66, network-observability/network-observability-operator-bundle 1.6.0-78, network-observability/network-observability-rhel9-operator v1.6.0-66, network-observability/network-observability-ebpf-agent-rhel9 v1.6.0-66, network-observability/network-observability-console-plugin-rhel9 v1.6.0-66, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.6.0-66
    fixed: vendor fix RHSA-2024:3868
  • Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.2-9
    fixed: vendor fix RHSA-2024:3790
  • Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 2.12.1-394, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8 2.12.1-394, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator 2.12.1-394, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle 2.12.1-394, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8 2.12.1-394
    fixed: vendor fix RHSA-2024:2901
  • Red Hat Enterprise Linux AppStream (v. 8) git-lfs 3.4.1-2.el8_10, delve 1.21.2-3.module+el8.10.0+21244+5b2d9000, golang 1.21.9-1.module+el8.10.0+21671+b35c3b78, go-toolset 1.21.9-1.module+el8.10.0+21671+b35c3b78, golang-bin 1.21.9-1.module+el8.10.0+21671+b35c3b78, golang-src 1.21.9-1.module+el8.10.0+21671+b35c3b78, +2 more
    fixed: vendor fix RHSA-2024:3259
  • Red Hat Enterprise Linux AppStream (v. 9) git-lfs 3.4.1-2.el9_4, golang 1.21.9-2.el9_4, go-toolset 1.21.9-2.el9_4, golang-bin 1.21.9-2.el9_4, golang-src 1.21.9-2.el9_4, golang-misc 1.21.9-2.el9_4, +1 more
    fixed: vendor fix RHSA-2024:2724
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-registry-rhel8 v1.8.4-11
    fixed: vendor fix RHSA-2024:7164
  • Red Hat OpenShift Container Platform 4.16 openshift 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, openshift 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9, openshift-kubelet 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, openshift-kubelet 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9, openshift-hyperkube 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, openshift-hyperkube 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9, +188 more
    fixed: vendor fix RHSA-2024:0045
  • Red Hat OpenShift distributed tracing 3.2 rhosdt/tempo-rhel8 2.4.2-3, rhosdt/tempo-query-rhel8 0.10.0-8, rhosdt/jaeger-agent-rhel8 1.57.0-5, rhosdt/jaeger-query-rhel8 1.57.0-5, rhosdt/tempo-gateway-rhel8 1.0.0-8, rhosdt/tempo-rhel8-operator 0.10.0-6, +13 more
    fixed: vendor fix RHSA-2024:3621
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.12.0-7.el8
    fixed: vendor fix RHSA-2024:4023
  • Red Hat OpenShift Serverless 1.33 openshift-serverless-1/client-kn-rhel8 1.12.0-4, openshift-serverless-1/func-utils-rhel8 1.33.0-4, openshift-serverless-1/serving-queue-rhel8 1.12.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.12.0-6, openshift-serverless-1/kourier-control-rhel8 1.12.0-4, openshift-serverless-1/serving-webhook-rhel8 1.12.0-4, +30 more
    fixed: vendor fix RHSA-2024:4028
  • Red Hat OpenStack Services on OpenShift rhoso-operators/sg-core-rhel9 1.0.4-4, rhoso-operators/ovn-rhel9-operator 1.0.4-4, rhoso-operators/heat-rhel9-operator 1.0.4-4, rhoso-operators/nova-rhel9-operator 1.0.4-4, rhoso-operators/test-rhel9-operator 1.0.4-4, rhoso-operators/infra-rhel9-operator 1.0.4-4, +19 more
    fixed: vendor fix RHSA-2024:9485
  • Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.2-6, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.2-4, advanced-cluster-security/rhacs-scanner-rhel8 4.4.2-4, advanced-cluster-security/rhacs-rhel8-operator 4.4.2-4, advanced-cluster-security/rhacs-collector-rhel8 4.4.2-4, advanced-cluster-security/rhacs-operator-bundle 4.4.2-6, +7 more
    fixed: vendor fix RHSA-2024:2941
  • Red Hat RHOL 5.9 for RHEL 9 openshift-logging/logging-loki-rhel9 v2.9.6-12
    fixed: vendor fix RHSA-2024:2096
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.16 python-pyasn1 0.5.1-3.el9, python3-pyasn1 0.5.1-3.el9, pysnmp-lextudio 5.0.26-2.el9, python-eventlet 0.33.1-6.el9, python-gunicorn 20.0.4-4.el9, python3-eventlet 0.33.1-6.el9, +139 more Red Hat Migration Toolkit for Applications 7 mta/mta-hub-rhel8 Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-rhel9-operator 1.3.2-9, oadp/oadp-operator-bundle 1.3.2-19, oadp/oadp-mustgather-rhel9 1.3.2-19, oadp/oadp-velero-plugin-rhel9 1.3.2-9, oadp/oadp-velero-plugin-for-aws-rhel9 1.3.2-9, oadp/oadp-velero-plugin-for-csi-rhel9 1.3.2-9, +4 more
    not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.08% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.21.8
>=1.22.0-0, <1.22.1
1.21.8
1.22.1
go stdlib
<1.21.8
>=1.22.0-0, <1.22.1
1.21.8
1.22.1

Affected products

  • Go standard library net/http
  • Go standard library net/http/cookiejar

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.