CVE-2023-45289: Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
Other sources
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-45289?
CVE-2023-45289 is classified as a medium-severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2023-45289?
To mitigate CVE-2023-45289, upgrade your Go package to version 1.21.8, 1.22.1, or 1.22.11-1 depending on your distribution.
What types of software are affected by CVE-2023-45289?
CVE-2023-45289 affects multiple Go package versions and IBM's Concert Software up to version 1.0.2.1.
What kind of attack can exploit CVE-2023-45289?
CVE-2023-45289 can be exploited by a remote attacker sending specially crafted HTTP requests to gain sensitive information.
Is there a workaround for CVE-2023-45289 if I cannot upgrade?
Currently, there is no known workaround for CVE-2023-45289, and upgrading is strongly advised.