amphp/http-client Header leakage on cross-domain redirects

published 2024-05-15 2y ago modified 2024-11-29 last yr.

cvss: 4.0; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

amphp/http-client has a security weakness that might leak sensitive request headers from the initial request to the redirected host on cross-domain redirects, which were not removed correctly. `Message::setHeaders` does not replace the entire set of headers, but only operates on the headers matching the given array keys.

Patch / fix

fixed in 1 links 2

packagist amphp/http-client 4.4.0

github.com/amphp/http-client@fa79253 commit
github.com/amphp/http-client/releases/tag/v4.4.0 release

Is GHSA-8jp9-mpv9-98rj in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	4.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	amphp/http-client	>=4.0.0, <4.4.0	4.4.0

References

Sources

GitHub Advisory GHSA-8jp9-mpv9-98rj

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.