CVE-2024-28110: 
Red Hat Enterprise Linux CoreOS (RHCOS) vulnerability analysis and mitigation

CVE-2024-28110 affects the Go SDK for CloudEvents, which is the official CloudEvents SDK for application integration. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. The vulnerability was discovered and disclosed on March 6, 2024 (GitHub Advisory).

The vulnerability occurs when using cloudevents.WithRoundTripper to create a Client. When the transport is populated with an authenticated transport (such as oauth2.Transport or idtoken.NewClient(...).Transport), http.DefaultClient is modified with the authenticated transport. This modification causes the client to send Authorization tokens to any endpoint it contacts, not just the intended ones. The issue has been assigned a CVSS v3.1 base score of 7.5 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The vulnerability leads to credential leakage, where authentication tokens intended for specific endpoints are inadvertently sent to any endpoint the application communicates with. This could potentially expose sensitive authentication credentials to unauthorized parties or malicious endpoints (GitHub Advisory).

The vulnerability is exploitable when an application uses the WithRoundTripper option to create a CloudEvents client with an authenticated transport. The issue affects all versions of the SDK prior to version 2.15.2 (GitHub Advisory).

The vulnerability has been patched in version 2.15.2 of the CloudEvents Go SDK. Users should upgrade to this version or later to address the credential leakage issue. The fix involves modifying how the HTTP client is initialized to prevent the authenticated transport from being used process-wide (GitHub Commit).