CVE-2022-31091
published 2022-06-27CVE-2022-31091: Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request…
PriorityP344high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
1.41%
69.7th percentile
Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | guzzle | < guzzle 7.4.5-1 (bookworm) | guzzle 7.4.5-1 (bookworm) |
| debian | mediawiki | < guzzle 7.4.5-1 (bookworm) | guzzle 7.4.5-1 (bookworm) |
| guzzle | guzzle | < 6.5.8 | 6.5.8 |
| guzzle | guzzle | — | — |
| guzzle | guzzle | >= 0 < 7.4.5-1 | 7.4.5-1 |
| guzzle | guzzle | >= 0 < 7.4.5-1 | 7.4.5-1 |
| guzzle | guzzle | >= 0 < 7.4.5-1 | 7.4.5-1 |
| guzzlehttp | guzzle | >= 0 < 6.5.8 | 6.5.8 |
| guzzlehttp | guzzle | >= 7.0.0 < 7.4.5 | 7.4.5 |
| guzzlephp | guzzle | < 6.5.8 | 6.5.8 |
| guzzlephp | guzzle | >= 7.0.0 < 7.4.5 | 7.4.5 |
| mediawiki | mediawiki | >= 0 < 1:1.35.8-1~deb11u1 | 1:1.35.8-1~deb11u1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.7-1 | 1:1.35.7-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.7-1 | 1:1.35.7-1 |
| mediawiki | mediawiki | >= 0 < 1:1.35.7-1 | 1:1.35.7-1 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
ghsa6.5MEDIUM
osv7.7HIGH
vendor_debian7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-31091: Guzzle, an extensible PHP HTTP client
osv·2022-06-27·CVSS 7.7
CVE-2022-31091 [HIGH] CVE-2022-31091: Guzzle, an extensible PHP HTTP client
Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternati
GHSA
Change in port should be considered a change in origin
ghsa·2022-06-21·CVSS 6.5
CVE-2022-31091 [MEDIUM] CWE-200 Change in port should be considered a change in origin
Change in port should be considered a change in origin
### Impact
`Authorization` and `Cookie` headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme downgrade. Now, we consider any change in host, port or scheme to be a change in origin.
### Patches
Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5.
### Workarounds
An alternative approach would be to use your own redirect middleware, rather than ours, if you are un
OSV
Change in port should be considered a change in origin
osv·2022-06-21·CVSS 6.5
CVE-2022-31091 [MEDIUM] Change in port should be considered a change in origin
Change in port should be considered a change in origin
### Impact
`Authorization` and `Cookie` headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme downgrade. Now, we consider any change in host, port or scheme to be a change in origin.
### Patches
Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5.
### Workarounds
An alternative approach would be to use your own redirect middleware, rather than ours, if you are un
Debian
CVE-2022-31091: guzzle - Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on r...
vendor_debian·2022·CVSS 7.7
CVE-2022-31091 [HIGH] CVE-2022-31091: guzzle - Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on r...
Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternati
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699https://security.gentoo.org/glsa/202305-24https://www.debian.org/security/2022/dsa-5246https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699https://security.gentoo.org/glsa/202305-24https://www.debian.org/security/2022/dsa-5246
2022-06-27
Published