Description
macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | ior +10 | 1.1.6-1.el8 | RHSA-2020:3369 |
| Red Hat Service Mesh 1 | kiali | v1.12.10.redhat2-1.el7 | RHSA-2020:3369 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.4.3-13.el8 | RHSA-2020:3369 |
| Red Hat Service Mesh 1 | servicemesh-operator | 1.1.6-2.el8 | RHSA-2020:3369 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.14.0-14.el8 | RHSA-2020:3369 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | gopkg.in/macaron.v1 | < 1.3.7 | 1.3.7 | GHSA-733f-44f3-3frw |
Advisories 2
- RHSA-2020:3369 Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- WID-SEC-2023-2981 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2023