CVE-2022-31090
published 2022-06-27CVE-2022-31090: Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is…
PriorityP346high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
1.76%
75.5th percentile
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle steam handler backend, rather than curl.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | guzzle | < guzzle 7.4.5-1 (bookworm) | guzzle 7.4.5-1 (bookworm) |
| debian | mediawiki | < guzzle 7.4.5-1 (bookworm) | guzzle 7.4.5-1 (bookworm) |
| guzzle | guzzle | < 6.5.8 | 6.5.8 |
| guzzle | guzzle | — | — |
| guzzle | guzzle | >= 0 < 7.4.5-1 | 7.4.5-1 |
| guzzle | guzzle | >= 0 < 7.4.5-1 | 7.4.5-1 |
| guzzle | guzzle | >= 0 < 7.4.5-1 | 7.4.5-1 |
| guzzlehttp | guzzle | >= 0 < 6.5.8 | 6.5.8 |
| guzzlehttp | guzzle | >= 7.0.0 < 7.4.5 | 7.4.5 |
| guzzlephp | guzzle | < 6.5.8 | 6.5.8 |
| guzzlephp | guzzle | >= 7.0.0 < 7.4.5 | 7.4.5 |
| mediawiki | mediawiki | >= 0 < 1:1.35.8-1~deb11u1 | 1:1.35.8-1~deb11u1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.7-1 | 1:1.35.7-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.7-1 | 1:1.35.7-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.7-1 | 1:1.35.7-1 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
ghsa6.5MEDIUM
osv7.7HIGH
vendor_debian7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2022-31090: guzzle - Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are s...
vendor_debian·2022·CVSS 7.7
CVE-2022-31090 [HIGH] CVE-2022-31090: guzzle - Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are s...
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of
OSV
CVE-2022-31090: Guzzle, an extensible PHP HTTP client
osv·2022-06-27·CVSS 7.7
CVE-2022-31090 [HIGH] CVE-2022-31090: Guzzle, an extensible PHP HTTP client
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of
GHSA
CURLOPT_HTTPAUTH option not cleared on change of origin
ghsa·2022-06-21·CVSS 6.5
CVE-2022-31090 [MEDIUM] CWE-200 CURLOPT_HTTPAUTH option not cleared on change of origin
CURLOPT_HTTPAUTH option not cleared on change of origin
### Impact
`Authorization` headers on requests are sensitive information. When using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin, if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` and `CURLOPT_USERPWD` options before continuing, stopping curl from appending the `Authorization` header to the new request. Previously, we would only consider a change in host. Now, we consider any change in host, port or scheme to be a change in origin.
### Patches
Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle s
OSV
CURLOPT_HTTPAUTH option not cleared on change of origin
osv·2022-06-21·CVSS 6.5
CVE-2022-31090 [MEDIUM] CURLOPT_HTTPAUTH option not cleared on change of origin
CURLOPT_HTTPAUTH option not cleared on change of origin
### Impact
`Authorization` headers on requests are sensitive information. When using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin, if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` and `CURLOPT_USERPWD` options before continuing, stopping curl from appending the `Authorization` header to the new request. Previously, we would only consider a change in host. Now, we consider any change in host, port or scheme to be a change in origin.
### Patches
Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle s
No detection rules found.
No public exploits indexed.
https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82https://github.com/guzzle/guzzle/security/advisories/GHSA-25mq-v84q-4j7rhttps://security.gentoo.org/glsa/202305-24https://www.debian.org/security/2022/dsa-5246https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82https://github.com/guzzle/guzzle/security/advisories/GHSA-25mq-v84q-4j7rhttps://security.gentoo.org/glsa/202305-24https://www.debian.org/security/2022/dsa-5246
2022-06-27
Published