CVE-2022-31043

Guzzle is an open source PHP HTTP client. In affected versions Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This ...

GHSA-F2WF-25XC-69C9 Failure to strip the Cookie header on change in host or HTTP downgrade

Impact Cookie headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward...

GHSA-W248-FFJ2-4V5Q Fix failure to strip Authorization header on HTTP downgrade

Impact Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This is much the same as to how we don't forward on the heade...

Fix failure to strip Authorization header on HTTP downgrade

Impact Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This is much the same as to how we don't forward on the heade...

Failure to strip the Cookie header on change in host or HTTP downgrade

Impact Cookie headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward...

Fix failure to strip Authorization header on HTTP downgrade

Impact Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This is much the same as to how we don't forward on the heade...

PT-2022-3247 · Guzzle +1 · Guzzle +1

Name of the Vulnerable Software and Affected Versions: Guzzle versions prior to 6.5.7 Guzzle versions prior to 7.4.4 Description: The Cookie headers on requests are sensitive information. When making a request using the https scheme to a server that responds with a redirect to a URI with the http...

CVE-2022-31043

CVE-2022-31043 affects the PHP HTTP client Guzzle . The vulnerability arises when a request uses HTTPS and the server redirects to an HTTP URI, causing the Authorization header to be forwarded when it should be stripped. Prior fixes removed the header for host changes but not for scheme changes, ...

CVE-2022-31043 Fix failure to strip Authorization header on HTTP downgrade in Guzzle

Guzzle is an open source PHP HTTP client. In affected versions Authorization headers on requests are sensitive information. On making a request using the https scheme to a server which responds with a redirect to a URI with the http scheme, we should not forward the Authorization header on. This ...

The vulnerability of the Core sub-component of the Oracle WebLogic Server component of the Oracle Fusion Middleware software platform allows attackers to execute arbitrary code. This vulnerability also affects the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Core component of the Oracle WebLogic Server software platform within Oracle Fusion Middleware exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely, as well as compromise the...

The vulnerability of the Core sub-component of the Oracle WebLogic Server software, a software platform of Oracle Fusion Middleware. This vulnerability allows attackers to execute arbitrary code, and also affects the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Core component of the Oracle WebLogic Server software platform within Oracle Fusion Middleware exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely, as well as compromise the...

Path Traversal

djangos3file is vulnerable to path traversal. The vulnerability exists in the S3FileMiddleware function in middleware.py due to lack of input validation in the form field which allows an malicious user to access and modify system data...

Failure to strip Authentication header on HTTP downgrade

The Guzzle redirect middleware fails to strip the Authorization header when a redirect downgrades from https to http. The middleware currently only checks if the host has changed...

Drupal Third-party Library Information Disclosure Vulnerability (SA-CORE-2022-010) - Windows

Drupal is prone to a information disclosure vulnerability in the third-party Guzzle library. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

PT-2022-20452 · Vapor · Vapor

Name of the Vulnerable Software and Affected Versions: Vapor versions prior to 4.60.3 Description: Vapor is an HTTP web framework for Swift. Users with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. This issue can be triggered by invalid...

OS Command Injection

rack is vulnerable to OS command injection. The vulnerability exists in log function in CommonLogger and Lint middleware because of the escape sequences which allows an attacker to execute shell commands...

Arbitrary Code Injection

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

Possible shell escape sequence injection vulnerability in Rack

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted...

GHSA-WQ4H-7R42-5HRR Possible shell escape sequence injection vulnerability in Rack

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted...

PT-2022-3423

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.9.1 Rack versions prior to 2.1.4.1 Rack versions prior to 2.2.3.1 Description A sequence injection vulnerability exists in Rack, which could allow a possible shell escape in the Lint and CommonLogger components. This...