vulnerability

Red Hat OpenShift: CVE-2021-33197: ReverseProxy forwards connection headers if first one is empty

Try Surface Command
Back to search
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
2021-08-02
Added
2021-08-12
Modified
2025-04-11

Description

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

Solution(s)

linuxrpm-upgrade-atomic-openshift-service-idlerlinuxrpm-upgrade-butanelinuxrpm-upgrade-containernetworking-pluginslinuxrpm-upgrade-cri-olinuxrpm-upgrade-cri-toolslinuxrpm-upgrade-golang-github-prometheus-promulinuxrpm-upgrade-ignitionlinuxrpm-upgrade-openshiftlinuxrpm-upgrade-openshift-clientslinuxrpm-upgrade-openshift4-wincw-windows-machine-config-rhel8-operatorlinuxrpm-upgrade-redhat-release-coreos

References

Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today