CVE-2022-29248

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3
contains a vulnerability with the cookie middleware. The vulnerability is
that it is not checked if the cookie domain equals the domain of the server
which sets the cookie via the Set-Cookie header, allowing a malicious
server to set cookies for unrelated domains. The cookie middleware is
disabled by default, so most library consumers will not be affected by this
issue. Only those who manually add the cookie middleware to the handler
stack or construct the client with [‘cookies’ => true] are affected.
Moreover, those who do not use the same Guzzle client to call multiple
domains and have disabled redirect forwarding are not affected by this
vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this
issue. As a workaround, turn off the cookie middleware.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011636&gt;