csaf_redhat - rhsa-2025:3772

rhsa-2025:3772

Vulnerability from csaf_redhat

Published

2025-04-10 01:06

Modified

2025-04-24 10:19

Summary

Red Hat Security Advisory: go-toolset:rhel8 security update

Notes

Topic

An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341) * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341)\n\n* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2025:3772",
            url: "https://access.redhat.com/errata/RHSA-2025:3772",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#moderate",
            url: "https://access.redhat.com/security/updates/classification/#moderate",
         },
         {
            category: "external",
            summary: "2341750",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2341750",
         },
         {
            category: "external",
            summary: "2341751",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=2341751",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3772.json",
         },
      ],
      title: "Red Hat Security Advisory: go-toolset:rhel8 security update",
      tracking: {
         current_release_date: "2025-04-24T10:19:31+00:00",
         generator: {
            date: "2025-04-24T10:19:31+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.4.2",
            },
         },
         id: "RHSA-2025:3772",
         initial_release_date: "2025-04-10T01:06:33+00:00",
         revision_history: [
            {
               date: "2025-04-10T01:06:33+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2025-04-10T01:06:33+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2025-04-24T10:19:31+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux AppStream (v. 8)",
                        product: {
                           name: "Red Hat Enterprise Linux AppStream (v. 8)",
                           product_id: "AppStream-8.10.0.Z.MAIN.EUS",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:enterprise_linux:8::appstream",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "go-toolset:rhel8:8100020250321121115:a3795dee",
                        product: {
                           name: "go-toolset:rhel8:8100020250321121115:a3795dee",
                           product_id: "go-toolset:rhel8:8100020250321121115:a3795dee",
                           product_identification_helper: {
                              purl: "pkg:rpmmod/redhat/go-toolset@rhel8:8100020250321121115:a3795dee",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                        product: {
                           name: "golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_id: "golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-docs@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                        product: {
                           name: "golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_id: "golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-misc@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                        product: {
                           name: "golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_id: "golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-src@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                        product: {
                           name: "golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_id: "golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-tests@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                        product: {
                           name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                           product_id: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                        product: {
                           name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                           product_id: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/go-toolset@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                        product: {
                           name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                           product_id: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                        product: {
                           name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_id: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                        product: {
                           name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_id: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve-debuginfo@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                        product: {
                           name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_id: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve-debugsource@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                        product: {
                           name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_id: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/go-toolset@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                        product: {
                           name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_id: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=aarch64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                        product: {
                           name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_id: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-bin@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=aarch64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                        product: {
                           name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_id: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                        product: {
                           name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_id: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve-debuginfo@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                        product: {
                           name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_id: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve-debugsource@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                        product: {
                           name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_id: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/go-toolset@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                        product: {
                           name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_id: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=ppc64le",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                        product: {
                           name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_id: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-bin@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=ppc64le",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                        product: {
                           name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_id: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                        product: {
                           name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_id: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve-debuginfo@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                        product: {
                           name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_id: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/delve-debugsource@1.24.1-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                        product: {
                           name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_id: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/go-toolset@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                        product: {
                           name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_id: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                        product: {
                           name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_id: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-bin@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=x86_64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                        product: {
                           name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                           product_id: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/go-toolset@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                        product: {
                           name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                           product_id: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                        product: {
                           name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                           product_id: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/golang-bin@1.23.6-1.module%2Bel8.10.0%2B22945%2Bb2c96a17?arch=s390x",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
            },
            product_reference: "go-toolset:rhel8:8100020250321121115:a3795dee",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
            },
            product_reference: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            },
            product_reference: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
            },
            product_reference: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
            },
            product_reference: "delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
            },
            product_reference: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            },
            product_reference: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
            },
            product_reference: "delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
            },
            product_reference: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            },
            product_reference: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
            },
            product_reference: "delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
            },
            product_reference: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            },
            product_reference: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
            },
            product_reference: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
            },
            product_reference: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
            },
            product_reference: "go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
            },
            product_reference: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            },
            product_reference: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
            },
            product_reference: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
            },
            product_reference: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
            },
            product_reference: "golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
            },
            product_reference: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            },
            product_reference: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
            },
            product_reference: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64 as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
            },
            product_reference: "golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            },
            product_reference: "golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            },
            product_reference: "golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            },
            product_reference: "golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch as a component of go-toolset:rhel8:8100020250321121115:a3795dee as a component of Red Hat Enterprise Linux AppStream (v. 8)",
               product_id: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            },
            product_reference: "golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            relates_to_product_reference: "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-45336",
         cwe: {
            id: "CWE-200",
            name: "Exposure of Sensitive Information to an Unauthorized Actor",
         },
         discovery_date: "2025-01-23T12:57:38.123000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2341751",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-45336",
            },
            {
               category: "external",
               summary: "RHBZ#2341751",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2341751",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-45336",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-45336",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-45336",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-45336",
            },
         ],
         release_date: "2025-01-17T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-04-10T01:06:33+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:3772",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect",
      },
      {
         cve: "CVE-2024-45341",
         cwe: {
            id: "CWE-347",
            name: "Improper Verification of Cryptographic Signature",
         },
         discovery_date: "2025-01-23T12:26:31.454000+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "2341750",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this issue only affects users of private PKIs that make use of URIs.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2024-45341",
            },
            {
               category: "external",
               summary: "RHBZ#2341750",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2341750",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2024-45341",
               url: "https://www.cve.org/CVERecord?id=CVE-2024-45341",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2024-45341",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2024-45341",
            },
         ],
         release_date: "2025-01-17T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2025-04-10T01:06:33+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2025:3772",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.2,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debuginfo-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:delve-debugsource-0:1.24.1-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:go-toolset-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.src",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.aarch64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.ppc64le",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.s390x",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-bin-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.x86_64",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-docs-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-misc-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-src-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
                  "AppStream-8.10.0.Z.MAIN.EUS:go-toolset:rhel8:8100020250321121115:a3795dee:golang-tests-0:1.23.6-1.module+el8.10.0+22945+b2c96a17.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints",
      },
   ],
}

cve-2024-45341

Vulnerability from cvelistv5

Published

2025-01-28 01:03

Modified

2025-02-21 18:03

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

References

▼	URL	Tags
	https://go.dev/cl/643099
	https://go.dev/issue/71156
	https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
	https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
	https://pkg.go.dev/vuln/GO-2025-3373

Impacted products

	Vendor	Product	Version
	Go standard library	crypto/x509	Version: 0 ≤ Version: 1.23.0-0 ≤ Version: 1.24.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 6.1,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "LOW",
                     integrityImpact: "LOW",
                     privilegesRequired: "NONE",
                     scope: "CHANGED",
                     userInteraction: "REQUIRED",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-45341",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-28T14:57:00.467281Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-28T15:16:58.278Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-02-21T18:03:33.296Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250221-0004/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://pkg.go.dev",
               defaultStatus: "unaffected",
               packageName: "crypto/x509",
               product: "crypto/x509",
               programRoutines: [
                  {
                     name: "matchURIConstraint",
                  },
                  {
                     name: "CertPool.AppendCertsFromPEM",
                  },
                  {
                     name: "Certificate.CheckCRLSignature",
                  },
                  {
                     name: "Certificate.CheckSignature",
                  },
                  {
                     name: "Certificate.CheckSignatureFrom",
                  },
                  {
                     name: "Certificate.CreateCRL",
                  },
                  {
                     name: "Certificate.Verify",
                  },
                  {
                     name: "Certificate.VerifyHostname",
                  },
                  {
                     name: "CertificateRequest.CheckSignature",
                  },
                  {
                     name: "CreateCertificate",
                  },
                  {
                     name: "CreateCertificateRequest",
                  },
                  {
                     name: "CreateRevocationList",
                  },
                  {
                     name: "DecryptPEMBlock",
                  },
                  {
                     name: "EncryptPEMBlock",
                  },
                  {
                     name: "HostnameError.Error",
                  },
                  {
                     name: "MarshalECPrivateKey",
                  },
                  {
                     name: "MarshalPKCS1PrivateKey",
                  },
                  {
                     name: "MarshalPKCS1PublicKey",
                  },
                  {
                     name: "MarshalPKCS8PrivateKey",
                  },
                  {
                     name: "MarshalPKIXPublicKey",
                  },
                  {
                     name: "ParseCRL",
                  },
                  {
                     name: "ParseCertificate",
                  },
                  {
                     name: "ParseCertificateRequest",
                  },
                  {
                     name: "ParseCertificates",
                  },
                  {
                     name: "ParseDERCRL",
                  },
                  {
                     name: "ParseECPrivateKey",
                  },
                  {
                     name: "ParsePKCS1PrivateKey",
                  },
                  {
                     name: "ParsePKCS1PublicKey",
                  },
                  {
                     name: "ParsePKCS8PrivateKey",
                  },
                  {
                     name: "ParsePKIXPublicKey",
                  },
                  {
                     name: "ParseRevocationList",
                  },
                  {
                     name: "RevocationList.CheckSignatureFrom",
                  },
                  {
                     name: "SetFallbackRoots",
                  },
                  {
                     name: "SystemCertPool",
                  },
               ],
               vendor: "Go standard library",
               versions: [
                  {
                     lessThan: "1.22.11",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "1.23.5",
                     status: "affected",
                     version: "1.23.0-0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "1.24.0-rc.2",
                     status: "affected",
                     version: "1.24.0-0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Juho Forsén of Mattermost",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-295: Improper Certificate Validation",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-30T19:14:21.421Z",
            orgId: "1bb62c36-49e3-4200-9d77-64a1400537cc",
            shortName: "Go",
         },
         references: [
            {
               url: "https://go.dev/cl/643099",
            },
            {
               url: "https://go.dev/issue/71156",
            },
            {
               url: "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ",
            },
            {
               url: "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ",
            },
            {
               url: "https://pkg.go.dev/vuln/GO-2025-3373",
            },
         ],
         title: "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509",
      },
   },
   cveMetadata: {
      assignerOrgId: "1bb62c36-49e3-4200-9d77-64a1400537cc",
      assignerShortName: "Go",
      cveId: "CVE-2024-45341",
      datePublished: "2025-01-28T01:03:24.353Z",
      dateReserved: "2024-08-27T19:41:58.556Z",
      dateUpdated: "2025-02-21T18:03:33.296Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-45336

Vulnerability from cvelistv5

Published

2025-01-28 01:03

Modified

2025-02-21 18:03

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

References

▼	URL	Tags
	https://go.dev/cl/643100
	https://go.dev/issue/70530
	https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
	https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
	https://pkg.go.dev/vuln/GO-2025-3420

Impacted products

	Vendor	Product	Version
	Go standard library	net/http	Version: 0 ≤ Version: 1.23.0-0 ≤ Version: 1.24.0-0 ≤

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 6.1,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "LOW",
                     integrityImpact: "LOW",
                     privilegesRequired: "NONE",
                     scope: "CHANGED",
                     userInteraction: "REQUIRED",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-45336",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-28T14:56:59.058895Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-28T15:16:38.044Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2025-02-21T18:03:31.299Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20250221-0003/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://pkg.go.dev",
               defaultStatus: "unaffected",
               packageName: "net/http",
               product: "net/http",
               programRoutines: [
                  {
                     name: "Client.do",
                  },
                  {
                     name: "Client.makeHeadersCopier",
                  },
                  {
                     name: "shouldCopyHeaderOnRedirect",
                  },
                  {
                     name: "Client.Do",
                  },
                  {
                     name: "Client.Get",
                  },
                  {
                     name: "Client.Head",
                  },
                  {
                     name: "Client.Post",
                  },
                  {
                     name: "Client.PostForm",
                  },
                  {
                     name: "Get",
                  },
                  {
                     name: "Head",
                  },
                  {
                     name: "Post",
                  },
                  {
                     name: "PostForm",
                  },
               ],
               vendor: "Go standard library",
               versions: [
                  {
                     lessThan: "1.22.11",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "1.23.5",
                     status: "affected",
                     version: "1.23.0-0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "1.24.0-rc.2",
                     status: "affected",
                     version: "1.24.0-0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Kyle Seely",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "CWE-116: Improper Encoding or Escaping of Output",
                     lang: "en",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-30T19:14:21.805Z",
            orgId: "1bb62c36-49e3-4200-9d77-64a1400537cc",
            shortName: "Go",
         },
         references: [
            {
               url: "https://go.dev/cl/643100",
            },
            {
               url: "https://go.dev/issue/70530",
            },
            {
               url: "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ",
            },
            {
               url: "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ",
            },
            {
               url: "https://pkg.go.dev/vuln/GO-2025-3420",
            },
         ],
         title: "Sensitive headers incorrectly sent after cross-domain redirect in net/http",
      },
   },
   cveMetadata: {
      assignerOrgId: "1bb62c36-49e3-4200-9d77-64a1400537cc",
      assignerShortName: "Go",
      cveId: "CVE-2024-45336",
      datePublished: "2025-01-28T01:03:24.869Z",
      dateReserved: "2024-08-27T19:41:58.555Z",
      dateUpdated: "2025-02-21T18:03:31.299Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:3772

Vulnerability from csaf_redhat

cve-2024-45341

Vulnerability from cvelistv5

cve-2024-45336

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature