CVE-2024-45336

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.

Kyle Seely discovered that the Go net/http module did not properly handle sensitive headers during repeated redirects. An attacker could possibly use this issue to obtain sensitive information. Juho Fors�n discovered that the Go crypto/x509 module incorrectly handled IPv6 addresses during URI parsing. An attacker could possibly use this issue to bypass certificate URI constraints. It was discovered that the Go crypto module did not properly handle variable time instructions under certain circumstances on 64-bit Power systems. An attacker could possibly use this issue to expose sensitive information.