Information disclosure in Go programming language - CVE-2024-45336

Vulnerability identifier: #VU103455

CSH Severity: Low

CVSS v4 BT: 0.5 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-45336

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the HTTP client will send Authorization header to a third-party domain after a chain of redirects. A remote attacker can gain unauthorized access to credentials.

Go programming language
Oracle Linux
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Development Tools Module
openSUSE Leap
openEuler
Ubuntu
Oracle Solaris
IBM Concert Software
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Business Automation
Submariner
IBM Observability with Instana
IBM Cloud Pak for Security
Red Hat Advanced Cluster Management for Kubernetes
Splunk Operator for Kubernetes Add-on
IBM MQ Operator
OpenShift Logging
IBM Maximo Application Suite
IBM Business Automation Workflow
watsonx.data
Cloud Pak for Network Automation
IBM Cloud Pak for Watson AIOps
Storage Ceph
IBM Business Automation Manager Open Editions
Robotic Process Automation for Cloud Pak
Business Automation Insights
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
opentelemetry-collector (Red Hat package)
golang-help
golang-devel
golang
golang-1.22 (Ubuntu package)
go1.22-doc
go1.22-race
go1.22
go1.22-openssl
go1.22-openssl-doc
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.23-doc
go1.23
go1.23-race
go1.23-openssl-debuginfo
go1.23-openssl
go1.23-openssl-race
go1.23-openssl-doc
go1.24-doc
go1.24
go1.24-race
delve
go-toolset
golang-misc
golang-bin
golang-docs
golang-src
golang-tests
IBM API Connect
Planning Analytics Local
OpenShift Service Mesh
Red Hat Ceph Storage

Install updates from vendor's website.

Go programming language - addressed in versions 1.22.11, 1.23.5, 1.24 rc2
IBM Concert Software - update to 1.1.0
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.2
Cloud Pak for Network Automation - update to 2.7.8
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.0
IBM Cloud Pak for Watson AIOps - update to 4.10.0
Storage Ceph - update to 7.0z2
IBM Business Automation Manager Open Editions - update to 8.0.8
IBM API Connect - update to 10.0.8.2 ifix2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.21, 23.0.20.2
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM Cloud Pak for Business Automation - addressed in versions 24.0.1-IF006, 25.0.0-IF003
Submariner - update to 0.18.5
opentelemetry-collector (Red Hat package) - update to 0.107.0-7.el9_4
IBM Observability with Instana - update to 1.0.295
IBM Cloud Pak for Security - update to 1.11.2.0
golang-help - addressed in versions 1.15.7-50, 1.17.3-38, 1.21.4-31
golang-devel - addressed in versions 1.15.7-50, 1.17.3-38, 1.21.4-31
golang - addressed in versions 1.15.7-50, 1.17.3-38, 1.21.4-31
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.4, 1.22.2-2~22.04.3, 1.22.8-1ubuntu0.1
go1.22-doc - update to 1.22.11-150000.1.39.1
go1.22-race - update to 1.22.11-150000.1.39.1
go1.22 - update to 1.22.11-150000.1.39.1
go1.22-openssl - update to 1.22.12-150000.1.12.1
go1.22-openssl-doc - update to 1.22.12-150000.1.12.1
go1.22-openssl-debuginfo - update to 1.22.12-150000.1.12.1
go1.22-openssl-race - update to 1.22.12-150000.1.12.1
go1.23-doc - update to 1.23.5-150000.1.18.1
go1.23 - update to 1.23.5-150000.1.18.1
go1.23-race - update to 1.23.5-150000.1.18.1
go1.23-openssl-debuginfo - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-race - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.23-openssl-doc - addressed in versions 1.23.9-150000.1.9.1, 1.23.12-150600.13.9.1
go1.24-doc - update to 1.24 rc2-150000.1.3.1
go1.24 - update to 1.24 rc2-150000.1.3.1
go1.24-race - update to 1.24 rc2-150000.1.3.1
delve - update to 1.24.1-1.0.2
go-toolset - update to 1.24.4-1
golang-misc - update to 1.24.4-1.0.2
golang - update to 1.24.4-1.0.2
golang-bin - update to 1.24.4-1.0.2
golang-docs - update to 1.24.4-1.0.2
golang-src - update to 1.24.4-1.0.2
golang-tests - update to 1.24.4-1.0.2
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
OpenShift Service Mesh - update to 2.5.10
Red Hat Advanced Cluster Management for Kubernetes - update to 2.11.7
Splunk Operator for Kubernetes Add-on - update to 3.0.0
IBM MQ Operator - addressed in versions 3.2.12, 3.5.3, 9.4.2.1-r2
OpenShift Logging - update to 6.1.4
Red Hat Ceph Storage - update to 7.1
IBM Maximo Application Suite - addressed in versions 8.10.24, 8.11.21, 9.0.10
Oracle Solaris - addressed in versions 11.3 ESU 36.34, 11.4 SRU 80
IBM Business Automation Workflow - addressed in versions 24.0.0-IF005, 24.0.1-IF002

• https://go.dev/cl/643100
• https://go.dev/issue/70530
• https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
• https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
• https://pkg.go.dev/vuln/GO-2025-3420

• Multiple vulnerabilities in Google Go programming language
• SUSE update for go1.22
• SUSE update for go1.23
• SUSE update for go1.24
• openEuler 24.03 LTS SP1 update for golang
• openEuler 24.03 LTS update for golang
• openEuler 22.03 LTS SP3 update for golang
• openEuler 20.03 LTS SP4 update for golang
• Multiple vulnerabilities in OpenShift Logging 6.1
• Multiple vulnerabilities in IBM Maximo Application Suite
• Red Hat Enterprise Linux 8 update for the go-toolset:rhel8 module
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Oracle Solaris update for third-party components
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.11
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• Multiple vulnerabilities in Submariner 0.18
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• SUSE update for go1.23-openssl
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM API Connect
• Multiple vulnerabilities in IBM watsonx.data
• IBM Watson Speech Services Cartridge update for Golang/net/http
• Ubuntu update for golang-1.22
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Red Hat Enterprise Linux 9 update for opentelemetry-collector
• Anolis OS update for go-toolset:an8 module
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• SUSE update for go1.23-openssl
• Splunk Operator for Kubernetes Add-on update for third-party components
• Multiple vulnerabilities in Netcool Operations Insight
• IBM Storage Ceph update for Golang
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation