PT-2024-40197 · Unknown · Amphp/Http-Client

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: amphp/http-client (affected versions not specified)

Description: The issue is related to a security weakness that may cause sensitive request headers to leak from the initial request to the redirected host during cross-domain redirects. This happens because the headers were not removed correctly. The Message::setHeaders function does not replace the entire set of headers but only operates on the headers matching the given array keys.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-8JP9-MPV9-98RJ

Affected Products

Amphp/Http-Client

References · 5

• https://osv.dev/vulnerability/GHSA-8jp9-mpv9-98rj · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http-client/2020-06-16.yaml · Note
• https://github.com/amphp/http-client/commit/fa7925363e6d5a0d0d337e2e6eb1affb93cf226e · Note
• https://github.com/amphp/http-client/releases/tag/v4.4.0 · Note
• https://github.com/amphp/http-client · Note