[GO-2024-2600] Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

Affected Packages 4

Fixed Packages 4

CVEs 1

When following an HTTP redirect to a domain which is not a subdomain match or
exact match of the initial domain, an http.Client does not forward sensitive
headers such as "Authorization" or "Cookie". For example, a redirect from
foo.com to www.foo.com will forward the Authorization header, but a redirect to
bar.com will not.

A maliciously crafted HTTP redirect could cause sensitive headers to be
unexpectedly forwarded.

Package	Affected Version
pkg:golang/net/http/cookiejar	>= 1.22.0, < 1.21.8
pkg:golang/net/http/cookiejar	>= 1.22.0, < 1.22.1
pkg:golang/net/http	>= 1.22.0, < 1.21.8
pkg:golang/net/http	>= 1.22.0, < 1.22.1

Package	Fixed Version
pkg:golang/net/http/cookiejar	= 1.21.8
pkg:golang/net/http/cookiejar	= 1.22.1
pkg:golang/net/http	= 1.21.8
pkg:golang/net/http	= 1.22.1

ID

GO-2024-2600

URL

https://pkg.go.dev/vuln/GO-2024-2600

Published

2024-03-05T21:34:02
(6 months ago)

Modified

2024-07-17T19:54:18
(2 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version
Fixed	pkg:golang/net/http/cookiejar	net/http	cookiejar	= 1.21.8
Affected	pkg:golang/net/http/cookiejar	net/http	cookiejar	>= 1.22.0 < 1.21.8
Fixed	pkg:golang/net/http/cookiejar	net/http	cookiejar	= 1.22.1
Affected	pkg:golang/net/http/cookiejar	net/http	cookiejar	>= 1.22.0 < 1.22.1
Fixed	pkg:golang/net/http	net	http	= 1.21.8
Affected	pkg:golang/net/http	net	http	>= 1.22.0 < 1.21.8
Fixed	pkg:golang/net/http	net	http	= 1.22.1
Affected	pkg:golang/net/http	net	http	>= 1.22.0 < 1.22.1

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date