{"id":"CVE-2022-31043","aliases":["BIT-drupal-2022-31042","BIT-drupal-2022-31043","CLSA-2026-1779065200","CLSA-2026-1783645385","DEBIAN-CVE-2022-31043","DRUPAL-CORE-2022-011","DSA-5246-1","EUVD-2022-6168","GHSA-f2wf-25xc-69c9","GHSA-w248-ffj2-4v5q","MGASA-2022-0338","UBUNTU-CVE-2022-31043"],"status":"published","title":"Fix failure to strip Authorization header on HTTP downgrade in Guzzle","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01992,"percentile":0.80843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-212","CWE-863"],"published":"2022-06-09T00:00:00Z","modified":"2026-11-03T06:02:31Z","fixes":[{"ecosystem":"Packagist","package":"guzzlehttp/guzzle","fixed_in":["7.4.4","6.5.7"],"sources":["ghsa"]},{"ecosystem":"TuxCare:Packagist","package":"guzzlehttp/guzzle","fixed_in":["6.0.2-p2+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"guzzle","fixed_in":["7.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"guzzle","fixed_in":["7.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"guzzle","fixed_in":["7.4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.35.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.35.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.35.7-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"6.5.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"9.2.0"},{"fixed":"9.2.21"},{"introduced":"9.3.0"},{"fixed":"9.3.16"}]}],"bundled":2},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"9.2.0"},{"fixed":"9.2.21"},{"introduced":"9.3.0"},{"fixed":"9.3.16"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.3"},{"fixed":"6.3.3-p1+tuxcare"}]}],"versions":["6.3.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.2"},{"fixed":"6.0.2-p2+tuxcare"}]}],"versions":["6.0.2","6.0.2-p1+tuxcare"]},{"source":"osv","ecosystem":"Debian:12","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.7-1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"9.2.21"}]},{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"fixed":"9.3.16"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.12","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.0-beta1","8.9.0-beta2","8.9.0-beta3","8.9.0-rc1","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.14","8.9.15","8.9.16","8.9.17","8.9.18","8.9.19","8.9.2","8.9.20","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9","9.0.0","9.0.0-alpha1","9.0.0-alpha2","9.0.0-beta1","9.0.0-beta2","9.0.0-beta3","9.0.0-rc1","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.0-alpha1","9.1.0-beta1","9.1.0-rc1","9.1.0-rc2","9.1.0-rc3","9.1.1","9.1.10","9.1.11","9.1.12","9.1.13","9.1.14","9.1.15","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.0-alpha1","9.2.0-beta1","9.2.0-beta2","9.2.0-beta3","9.2.0-rc1","9.2.1","9.2.10","9.2.11","9.2.12","9.2.13","9.2.14","9.2.15","9.2.16","9.2.17","9.2.18","9.2.19","9.2.2","9.2.20","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.1","9.3.10","9.3.11","9.3.12","9.3.13","9.3.14","9.3.15","9.3.2","9.3.3","9.3.4","9.3.5","9.3.6","9.3.7","9.3.8","9.3.9"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.8-1~deb11u1"}]}],"versions":["1:1.35.2-1","1:1.35.3-1","1:1.35.4-1","1:1.35.4-1+deb11u2","1:1.35.4-1~deb11u1","1:1.35.5-1","1:1.35.5-2","1:1.35.6-1","1:1.35.7-1"],"bundled":15},{"source":"osv","ecosystem":"Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"6.5.7"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","5.0.0","5.0.1","5.0.2","5.0.3","5.1.0","5.2.0","5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","6.0.0","6.0.1","6.0.2","6.1.0","6.1.1","6.2.0","6.2.1","6.2.2","6.2.3","6.3.0","6.3.1","6.3.2","6.3.3","6.4.0","6.4.1","6.5.0","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.4"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.2.0","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"6.5.7"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","5.0.0","5.0.1","5.0.2","5.0.3","5.1.0","5.2.0","5.3.0","5.3.1","5.3.2","5.3.3","5.3.4","6.0.0","6.0.1","6.0.2","6.1.0","6.1.1","6.2.0","6.2.1","6.2.2","6.2.3","6.3.0","6.3.1","6.3.2","6.3.3","6.4.0","6.4.1","6.5.0","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"guzzlehttp/guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.4.4"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.2.0","7.3.0","7.4.0","7.4.1","7.4.2","7.4.3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.7-1.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.9.2-0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.9.2-0.1build1","7.13.1-1","7.15.1-1","7.15.2-1","7.15.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"guzzle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.9.2-0.1","7.9.2-0.1build1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"},{"vendor":"guzzle","product":"guzzle"},{"vendor":"guzzlephp","product":"guzzle"}],"references":[{"url":"https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://www.drupal.org/sa-core-2022-011","tags":["x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5246","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31043","tags":["web","advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31043.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w248-ffj2-4v5q"},{"url":"https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9","tags":["advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31042","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31042.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31043.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-31043","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/guzzle/CVE-2022-31042.yaml","tags":["web"]},{"url":"https://github.com/guzzle/guzzle","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0338.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30837","tags":["report"]},{"url":"https://github.com/guzzle/guzzle/security/advisories/GHSA-cwmx-hcrq-mhc3","tags":["advisory"]},{"url":"https://github.com/guzzle/guzzle/security/advisories/GHSA-q559-8m2m-g699","tags":["advisory"]},{"url":"https://github.com/guzzle/guzzle/security/advisories/GHSA-25mq-v84q-4j7r","tags":["advisory"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/PIPYDRSHXOYW5DB7X755QDNUV5EZWPWB/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-31043","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31043","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-31043","title":"Fix failure to strip Authorization header on HTTP downgrade in Guzzle","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2022-06-09T00:00:00Z","modified":"2025-04-23T18:18:11.546Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-6168","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2022-06-09T00:00:00Z","modified":"2025-04-23T18:18:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:08.95736Z"}],"ghsa":[{"id":"GHSA-w248-ffj2-4v5q","title":"Fix failure to strip Authorization header on HTTP downgrade","description":"### Impact\n\n`Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host.\n\n### Patches\n\nAffected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4.\n\n### Workarounds\n\nAn alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.\n\n### References\n\n* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)\n\n### For more information\n\nIf you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).\n","status":"published","published":"2022-06-09T23:47:23Z","modified":"2023-07-24T19:33:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-212","CWE-863"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2022-31043","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2022-06-10T00:15:07.757Z","modified":"2026-06-17T04:44:40.427Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:07:21.62951Z"}],"osv":[{"id":"CVE-2022-31042","title":"Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle","description":"Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.","status":"published","published":"2022-06-09T00:00:00Z","modified":"2026-10-28T02:30:57.012286768Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"CVE-2022-31043","title":"Fix failure to strip Authorization header on HTTP downgrade in Guzzle","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2022-06-09T00:00:00Z","modified":"2026-10-28T02:30:24.277373208Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-f2wf-25xc-69c9","title":"Failure to strip the Cookie header on change in host or HTTP downgrade","description":"### Impact\n\n`Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there.\n\n### Patches\n\nAffected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4.\n\n### Workarounds\n\nAn alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.\n\n### References\n\n* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)\n\n### For more information\n\nIf you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).\n","status":"published","published":"2022-06-09T23:47:25Z","modified":"2025-12-10T23:40:57.755467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"GHSA-w248-ffj2-4v5q","title":"Fix failure to strip Authorization header on HTTP downgrade","description":"### Impact\n\n`Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host.\n\n### Patches\n\nAffected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4.\n\n### Workarounds\n\nAn alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.\n\n### References\n\n* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)\n\n### For more information\n\nIf you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).\n","status":"published","published":"2022-06-09T23:47:23Z","modified":"2025-12-10T23:40:57.755467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-212","CWE-863"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2022-31043","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2022-06-10T00:15:00Z","modified":"2026-10-17T12:56:21.924684505Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"BIT-drupal-2022-31042","title":"Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle","description":"Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.","status":"published","published":"2024-03-06T10:52:15.08Z","modified":"2026-09-08T08:47:01.567531843Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"BIT-drupal-2022-31043","title":"Fix failure to strip Authorization header on HTTP downgrade in Guzzle","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2024-03-06T10:52:03.1Z","modified":"2026-09-08T08:47:01.671307914Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"CLSA-2026-1779065200","title":"TuxCare security update for guzzlehttp/guzzle (5 CVEs)","description":"TuxCare rebuilt guzzlehttp/guzzle to address 5 CVEs. Fixed in 6.3.3-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:47:59.556233957Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1783645385","title":"TuxCare security update for guzzlehttp/guzzle (1 CVE)","description":"TuxCare rebuilt guzzlehttp/guzzle to address 1 CVE. Fixed in 6.0.2-p2+tuxcare.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:47:47.916923882Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"DEBIAN-CVE-2022-31043","description":"Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.","status":"published","published":"2022-06-10T00:15:07.757Z","modified":"2026-11-03T06:02:31.652345238Z","updated_at":"2026-11-03T06:44:05.456691Z"},{"id":"DRUPAL-CORE-2022-011","description":"*Updated 22:00 UTC 2022-06-10: Added steps to update without `drupal/core-recommended`.*\n\nDrupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released two security advisories:\n\n* [Failure to strip the Cookie header on change in host or HTTP downgrade](https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9)\n* [Fix failure to strip Authorization header on HTTP downgrade](https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q)\n\nThese do not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites.\n\nWe are issuing this security advisory outside our regular [Drupal security release window schedule](https://www.drupal.org/node/1173280) since Guzzle has already published information about the vulnerabilities, and vulnerabilities might exist in contributed modules or custom modules that use Guzzle for outgoing requests. Guzzle has rated these vulnerabilities as high-risk.\n\nThis advisory is not covered by Drupal Steward.","status":"published","published":"2022-06-10T19:39:02Z","modified":"2026-09-19T16:26:39Z","updated_at":"2026-11-02T15:46:13.900249Z"},{"id":"DSA-5246-1","title":"mediawiki - security update","status":"published","published":"2022-10-04T00:00:00Z","modified":"2026-03-09T02:10:52.19395Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0338","title":"Updated mediawiki packages fix security vulnerability","description":"Username is not escaped in the \"welcomeuser\" message (T308471).\n\nBundled guzzlehttp/guzzle has been updated to 6.5.8, fixing several issues\n(CVE-2022-29248, CVE-2022-31042, CVE-2022-31043, CVE-2022-31090,\nCVE-2022-31091).\n","status":"published","published":"2022-09-16T19:39:55Z","modified":"2026-04-16T04:43:15.253187905Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}