Skip to content
OpenAdvisories
High · 7.7 CVE-2022-31091 EUVD-2022-6123GHSA-q559-8m2m-g699

Change in port should be considered a change in origin in Guzzle

Published Jun 27, 2022 · Updated Apr 23, 2025 · Assigned by GitHub_M

Description

Guzzle, an extensible PHP HTTP client. `Authorization` and `Cookie` headers on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

Affected products

VendorProductAffectedFixed
guzzle guzzle < 6.5.8, >=7.0.0, < 7.4.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 guzzle 7.4.5-1 —
Debian 14 mediawiki 1:1.35.7-1 —
Debian 13 guzzle 7.4.5-1 —
Debian 13 mediawiki 1:1.35.7-1 —
Debian 12 guzzle 7.4.5-1 —
Debian 12 mediawiki 1:1.35.7-1 —
Debian 11 mediawiki 1:1.35.8-1~deb11u1 DSA-5246-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 icinga-php-thirdparty +1 No fix yet —
Ubuntu 26.04 LTS icinga-php-thirdparty +1 No fix yet —
Ubuntu 25.10 icinga-php-thirdparty +1 No fix yet —
Ubuntu 24.04 LTS icinga-php-thirdparty +1 No fix yet —
Ubuntu 22.04 LTS icinga-php-thirdparty +1 No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS mediawiki No fix yet —
Ubuntu Pro 22.04 LTS civicrm +1 No fix yet —
Ubuntu Pro 20.04 LTS civicrm +1 No fix yet —
Ubuntu Pro 18.04 LTS civicrm No fix yet —
Ubuntu Pro 16.04 LTS civicrm No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist guzzlehttp/guzzle < 6.5.8 6.5.8 GHSA-q559-8m2m-g699
Packagist guzzlehttp/guzzle >= 7.0.0, < 7.4.5 7.4.5 GHSA-q559-8m2m-g699

Advisories 1

References