CVE-2024-45336 is a vulnerability in the Go net/http package where sensitive headers are incorrectly sent after a cross-domain redirect. This affects various Red Hat OpenShift Logging container images and the Go toolset in Red Hat Enterprise Linux 8. The issue could lead to unintended disclosure of sensitive HTTP headers during redirects. Red Hat has released updated packages for OpenShift Logging 6.1.4 and go-toolset:rhel8 module that fix this flaw. The advisories also address related vulnerabilities in other components. The vulnerability is rated medium severity by Red Hat and no active exploitation has been observed.

The vulnerability may cause sensitive HTTP headers to be sent to unintended domains following a cross-domain redirect, potentially exposing sensitive information. This could impact confidentiality of data handled by affected OpenShift Logging components and Go applications using the vulnerable net/http implementation. However, no known exploits in the wild have been reported, and the severity is assessed as medium.

Red Hat has released official security updates fixing CVE-2024-45336 in OpenShift Logging 6.1.4 and the go-toolset module for RHEL 8. Users should apply these updates promptly following Red Hat's published instructions to fully remediate the issue. For OpenShift Container Platform 4.17 and OpenShift Logging 6.1, refer to the respective Red Hat documentation for upgrade procedures. No additional mitigation steps are required beyond applying the official patches.