CVE-2023-45289

Al seguir una redirección HTTP a un dominio que no es una coincidencia de subdominio o una coincidencia exacta del dominio inicial, un cliente http.no reenvía encabezados confidenciales como "Autorización" o "Cookie". Por ejemplo, una redirección de foo.com a www.foo.com reenviará el encabezado de Autorización, pero una redirección a bar.com no. Una redirección HTTP creada con fines malintencionados podría provocar que se reenvíen inesperadamente encabezados confidenciales.

A flaw was found in Go's net/http/cookiejar standard library package. When following an HTTP redirect to a domain that is not a subdomain match or an exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

This update for go1.21-openssl fixes the following issues. Fixed denial of service due to improper 100-continue handling. Fixed mishandling of corrupt central directory record in archive/zip. Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip. Fixed arbitrary code execution during build on darwin in cmd/go. Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2. Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar. Fixed memory exhaustion in Request.ParseMultipartForm in net/http. Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509. Fixed comments in display names are incorrectly handled in net/mail. Fixed errors returned from MarshalJSON methods may break template escaping in html/template.