CVE-2022-31042 — Sensitive Information Exposure in Guzzle

CWE-200 — Sensitive Information Exposure CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer9 documents6 sources

Severity

7.5HIGHNVD

EPSS

1.5%

top 19.16%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Guzzle Mediawiki Drupal +4 more

Timeline

PublishedJun 10

Description

Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Coo…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶Packagistguzzlehttp/guzzle4.0.0 — 6.5.7+1

▶CVEListV5guzzle/guzzle< 6.5.7+1

▶NVDguzzlephp/guzzle7.0.0 — 7.4.4+1

▶Debianguzzle/guzzle< 7.4.4-1+2

▶Packagistdrupal/core8.0.0 — 9.2.21+1

Also affects: Debian Linux 11.0

Patches

Patch: github.com ↗Patch: www.drupal.org ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

CVE-2022-31042: *Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended`↗2022-06-10

▶

OSV

CVE-2022-31042: Guzzle is an open source PHP HTTP client↗2022-06-10

▶

GHSA

Failure to strip the Cookie header on change in host or HTTP downgrade↗2022-06-09

▶

OSV

Failure to strip the Cookie header on change in host or HTTP downgrade↗2022-06-09

▶

OSV

Fix failure to strip Authorization header on HTTP downgrade↗2022-06-09

▶

📋Vendor Advisories

Drupal

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-011↗2022-06-10

▶

Debian

CVE-2022-31042: guzzle - Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` head...↗2022

▶