PT-2022-20518 · Guzzle · Guzzle

Published 2022-06-21 · Updated 2023-07-24 · CVE-2022-31090

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 6.5.8 Guzzle versions prior to 7.4.5

Description Guzzle, an extensible PHP HTTP client, has a sensitive information leak issue. When using the Curl handler, the CURLOPT HTTPAUTH option can specify an Authorization header. If a request responds with a redirect to a different origin, the CURLOPT HTTPAUTH option should be removed to prevent curl from appending the Authorization header to the new request.

Recommendations For Guzzle 7 users, upgrade to version 7.4.5 as soon as possible. For users using any earlier series of Guzzle, upgrade to version 6.5.8 or 7.4.5. As a temporary workaround, consider disabling redirects altogether. Alternatively, specify to use the Guzzle stream handler backend, rather than curl.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-212

Related Identifiers

CVE-2022-31090

DSA-5246-1

GHSA-25MQ-V84Q-4J7R

MGASA-2022-0338

Affected Products

Guzzle

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31090.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31090.yaml · Exploit
• https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31090 · Vendor Advisory
• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-25mq-v84q-4j7r · Vendor Advisory
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31090 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0338 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31090 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-31090 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-31090 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0338.html · Security Note
• https://osv.dev/vulnerability/CVE-2022-31090 · Vendor Advisory