CVE-2025-46421 Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server
A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.
Problem types: cwe_id: CWE-497
description: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10.0
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/o:redhat:enterprise_linux:8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.2 Advanced Update Support
cpes: cpe:/a:redhat:rhel_aus:8.2::appstream
cpe:/o:redhat:rhel_aus:8.2::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
cpes: cpe:/o:redhat:rhel_e4s:8.4::baseos
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/o:redhat:rhel_tus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Telecommunications Update Service
cpes: cpe:/o:redhat:rhel_e4s:8.4::baseos
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/o:redhat:rhel_tus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
cpes: cpe:/o:redhat:rhel_e4s:8.4::baseos
cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_tus:8.4::appstream
cpe:/a:redhat:rhel_e4s:8.4::appstream
cpe:/o:redhat:rhel_tus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
cpes: cpe:/o:redhat:rhel_tus:8.6::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Telecommunications Update Service
cpes: cpe:/o:redhat:rhel_tus:8.6::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
cpes: cpe:/o:redhat:rhel_tus:8.6::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/a:redhat:rhel_tus:8.6::appstream
cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/a:redhat:rhel_e4s:8.6::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8.8 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:8.8::appstream
cpe:/o:redhat:rhel_eus:8.8::baseos
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
cpes: cpe:/a:redhat:rhel_e4s:9.0::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.2 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.2::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9.4 Extended Update Support
cpes: cpe:/a:redhat:rhel_eus:9.4::appstream
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 6
cpes: cpe:/o:redhat:enterprise_linux:6
default_status: unknown
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: unknown
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-04-24T13:01:24.589Z