{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"golang-1.19","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NJATZBVMH5R61CAC5GCCQS","modified_at":"2026-10-23T18:05:07.849870210Z","published_at":"2024-03-05T23:15:07.137Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2023-45289","https://security-tracker.debian.org/tracker/CVE-2023-45289"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2023-45289","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2023-45289"}],"summary":"When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as \"Authorization\" or \"Cookie\"."}