CVE-2022-31042 — Sensitive Information Exposure

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	guzzle	< guzzle 7.4.4-1 (bookworm)	guzzle 7.4.4-1 (bookworm)
debian	mediawiki	< guzzle 7.4.4-1 (bookworm)	guzzle 7.4.4-1 (bookworm)
drupal	core	>= 8.0.0 < 9.2.21	9.2.21
drupal	core	>= 9.3.0 < 9.3.16	9.3.16
drupal	drupal	—	—
drupal	drupal	>= 9.2.0 < 9.2.21	9.2.21
drupal	drupal	>= 9.3.0 < 9.3.16	9.3.16
drupal	drupal_core	—	—
guzzle	guzzle	< 6.5.7	6.5.7
guzzle	guzzle	—	—
guzzle	guzzle	>= 0 < 7.4.4-1	7.4.4-1
guzzle	guzzle	>= 0 < 7.4.4-1	7.4.4-1
guzzle	guzzle	>= 0 < 7.4.4-1	7.4.4-1
guzzlehttp	guzzle	>= 4.0.0 < 6.5.7	6.5.7
guzzlehttp	guzzle	>= 7.0.0 < 7.4.4	7.4.4
guzzlephp	guzzle	< 6.5.7	6.5.7
guzzlephp	guzzle	>= 7.0.0 < 7.4.4	7.4.4
mediawiki	mediawiki	>= 0 < 1:1.35.8-1~deb11u1	1:1.35.8-1~deb11u1
mediawiki	mediawiki	>= 0 < 1:1.35.7-1	1:1.35.7-1
mediawiki	mediawiki	>= 0 < 1:1.35.7-1	1:1.35.7-1
mediawiki	mediawiki	>= 0 < 1:1.35.7-1	1:1.35.7-1

OSV

CVE-2022-31042: *Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended`

osv·2022-06-10

CVE-2022-31042 CVE-2022-31042: *Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended` *Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended`.* Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories: * [Failure to strip the Cookie header on change in host or HTTP downgrade](https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9) * [Fix failure to strip Authorization header on HTTP downgrade](https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q) These do not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside our regular [Drupal security release window schedule](https://www.drupal.org/node/1173280) since Guzzle has already p

OSV

CVE-2022-31042: Guzzle is an open source PHP HTTP client

osv·2022-06-10·CVSS 7.5

CVE-2022-31042 [HIGH] CVE-2022-31042: Guzzle is an open source PHP HTTP client Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of

GHSA

Failure to strip the Cookie header on change in host or HTTP downgrade

ghsa·2022-06-09

CVE-2022-31042 [HIGH] CWE-200 Failure to strip the Cookie header on change in host or HTTP downgrade Failure to strip the Cookie header on change in host or HTTP downgrade ### Impact `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. ### Patches Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected us

OSV

Failure to strip the Cookie header on change in host or HTTP downgrade

osv·2022-06-09

CVE-2022-31042 [HIGH] Failure to strip the Cookie header on change in host or HTTP downgrade Failure to strip the Cookie header on change in host or HTTP downgrade ### Impact `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. ### Patches Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected us

OSV

Fix failure to strip Authorization header on HTTP downgrade

osv·2022-06-09

CVE-2022-31042 [HIGH] Fix failure to strip Authorization header on HTTP downgrade Fix failure to strip Authorization header on HTTP downgrade ### Impact `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. ### Patches Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. ### Workarounds An alternative approach would be to use your own redirect middleware, rat

Drupal

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011

vendor_drupal·2022-06-10

CVE-2022-31042 [MEDIUM] Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011 Title: Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011 Vulnerability Type: Third-party libraries Description: Updated 22:00 UTC 2022-06-10: Added steps to update without drupal/core-recommended . Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories: Failure to strip the Cookie header on change in host or HTTP downgrade Fix failure to strip Authorization header on HTTP downgrade These do not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside our regular Drupal security release window schedule since Guzzle has already published information about the vulnerabilities, and vulnerabi

Debian

CVE-2022-31042: guzzle - Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` head...

vendor_debian·2022·CVSS 7.5

CVE-2022-31042 [HIGH] CVE-2022-31042: guzzle - Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` head... Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of

CVE-2022-31042: Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the…

Affected

CVSS provenance