Red Hat Security Advisory: yggdrasil security update

Fixed packages 5

Vulnerabilities 2

• High 7.8
  CVE-2025-3931

  Yggdrasil: local privilege escalation in yggdrasil

  A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authenti…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Go
  May 14, 2025
• Medium 6.1
  CVE-2024-45336

  Sensitive headers incorrectly sent after cross-domain redirect in net/http

  The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subs…

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2362345
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7592.json
• report
  https://access.redhat.com/security/cve/CVE-2024-45336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2341751
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-45336
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-45336
• article
  https://github.com/golang/go/issues/70530
• article
  https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI
• report
  https://access.redhat.com/security/cve/CVE-2025-3931
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-3931
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-3931
• article
  https://github.com/RedHatInsights/yggdrasil/pull/336