PT-2022-20519 · Guzzle · Guzzle

Grahamcampbell · Published 2022-06-21 · Updated 2023-05-22 · CVE-2022-31091

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 6.5.8 Guzzle versions prior to 7.4.5

Description Guzzle, an extensible PHP HTTP client, has a issue where Authorization and Cookie headers on requests are sensitive information. In affected versions, when making a request that responds with a redirect to a URI with a different port, if the redirect is followed, the Authorization and Cookie headers should be removed from the request before proceeding. Previously, only changes in host or scheme would trigger this removal.

Recommendations For Guzzle 7 users, upgrade to version 7.4.5 as soon as possible. For users of any earlier series of Guzzle, upgrade to version 6.5.8 or 7.4.5. As a temporary workaround, consider using your own redirect middleware instead of the default one if you are unable to upgrade. If redirects are not required or expected, consider disabling redirects altogether.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-31091

DSA-5246-1

GHSA-Q559-8M2M-G699

MGASA-2022-0338

Affected Products

Guzzle

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31091.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31091.yaml · Exploit
• https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82 · Patch
• https://osv.dev/vulnerability/CVE-2022-31091 · Vendor Advisory
• https://debian.org/security/2022/dsa-5246 · Vendor Advisory
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5246-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31091 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0338 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31091 · Security Note
• https://osv.dev/vulnerability/GHSA-q559-8m2m-g699 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31091 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31091 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31091 · Vendor Advisory