PT-2025-4303 · Unknown · Guzzle Oauth Subscriber

Psyker156 · Published 2025-01-06 · Updated 2025-01-06 · CVE-2025-21617

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Guzzle OAuth Subscriber versions prior to 0.8.1

Description The issue concerns the Guzzle OAuth Subscriber, which signs Guzzle requests using OAuth 1.0. Prior to version 0.8.1, the Nonce generation does not utilize sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used.

Recommendations For versions prior to 0.8.1, upgrade to version 0.8.1 or higher to resolve the issue. As a temporary workaround, consider using TLS to encrypt communications and minimize the risk of replay attacks. Restrict access to sensitive resources when TLS cannot be used, to reduce the potential impact of a replay attack.

Exploit

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-21617

GHSA-237R-R8M4-4Q88

Affected Products

Guzzle Oauth Subscriber

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21617.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-21617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-21617 · Security Note
• https://osv.dev/vulnerability/GHSA-237r-r8m4-4q88 · Vendor Advisory
• https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88 · Note
• https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1 · Note
• https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192 · Note
• https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53 · Note
• https://github.com/guzzle/oauth-subscriber · Note
• https://t.me/cvedetector/14406 · Telegram Post
• https://twitter.com/CVEnew/status/1876352094854099223 · Twitter Post