Description

Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

Severity

 

CVSS Version 3.x CVSS Version 2.0

CVSS 3.x Severity and Metrics:

CNA:  GitHub, Inc.

Base Score:  7.7 HIGH

Vector:  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: The NVD and the CNA have provided the same score. When this occurs only the CNA information is displayed, but the Acceptance Level icon for the CNA is given a checkmark to signify NVD concurrence.

CVSS 2.0 Severity and Metrics:

NIST: NVD

Base Score:  4.0 MEDIUM

Vector:  (AV:N/AC:L/Au:S/C:P/I:N/A:N)

NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.

Note: NVD Analysts have published a CVSS score for this CVE based on publicly available information at the time of analysis. The CNA has not provided a score within the CVE List.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82	Patch  Third Party Advisory
https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699	Mitigation  Third Party Advisory
https://security.gentoo.org/glsa/202305-24
https://www.debian.org/security/2022/dsa-5246	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-noinfo	Insufficient Information	NIST
CWE-200	Exposure of Sensitive Information to an Unauthorized Actor	GitHub, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

4 change records found show changes

CVE Modified by GitHub, Inc. 5/21/2023 6:15:13 PM

Action	Type	Old Value	New Value
Added	Reference		https://security.gentoo.org/glsa/202305-24 [No Types Assigned]

Modified Analysis by NIST 12/02/2022 9:29:40 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Added	CWE		NIST NVD-CWE-noinfo
Changed	Reference Type	https://www.debian.org/security/2022/dsa-5246 No Types Assigned	https://www.debian.org/security/2022/dsa-5246 Third Party Advisory

CVE Modified by GitHub, Inc. 10/06/2022 4:15:21 PM

Action	Type	Old Value	New Value
Added	Reference		https://www.debian.org/security/2022/dsa-5246 [No Types Assigned]

Initial Analysis by NIST 7/11/2022 9:41:20 AM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR *cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* versions up to (excluding) 6.5.8 *cpe:2.3:a:guzzlephp:guzzle:*:*:*:*:*:*:*:* versions from (including) 7.0.0 up to (excluding) 7.4.5
Added	CVSS V2		NIST (AV:N/AC:L/Au:S/C:P/I:N/A:N)
Added	CVSS V3.1		NIST AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Changed	Reference Type	https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82 No Types Assigned	https://github.com/guzzle/guzzle/commit/1dd98b0564cb3f6bd16ce683cb755f94c10fbd82 Patch, Third Party Advisory
Changed	Reference Type	https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699 No Types Assigned	https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699 Mitigation, Third Party Advisory