guzzlehttp/guzzle vulnerabilities

Guzzle: Noncanonical host can bypass host-based checks

Affected

<7.15.2 · >=8.0.0 <8.0.1

Fixed in

7.15.2, 8.0.1

Guzzle: Noncanonical cookie domain keeps subdomain scope

Affected

<7.15.2 · >=8.0.0 <8.0.1

Fixed in

7.15.2, 8.0.1

Guzzle: URI fragments disclosed in redirect Referer headers

Affected

<7.15.1

Fixed in

7.15.1

Guzzle: Host-only cookie scope is not preserved

Affected

<7.15.1

Fixed in

7.15.1

Guzzle: Unbounded response cookies risk denial of service

Affected

<7.15.1

Fixed in

7.15.1

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

Affected

<7.12.3

Fixed in

7.12.3

Guzzle: Proxy-Authorization headers can be sent to origin servers

Affected

<7.14.2

Fixed in

7.14.2

guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts

Affected

<7.12.1

Fixed in

7.12.1

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

Affected

<7.12.1

Fixed in

7.12.1

Change in port should be considered a change in origin

Affected

<6.5.8 · >=7.0.0 <7.4.5

Fixed in

6.5.8, 7.4.5

CURLOPT_HTTPAUTH option not cleared on change of origin

Affected

<6.5.8 · >=7.0.0 <7.4.5

Fixed in

6.5.8, 7.4.5

Failure to strip the Cookie header on change in host or HTTP downgrade

Affected

>=4.0.0 <6.5.7 · >=7.0.0 <7.4.4

Fixed in

6.5.7, 7.4.4

Fix failure to strip Authorization header on HTTP downgrade

Affected

>=4.0.0 <6.5.7 · >=7.0.0 <7.4.4

Fixed in

6.5.7, 7.4.4

Cross-domain cookie leakage in Guzzle

Affected

<6.5.6 · >=7.0.0 <7.4.3

Fixed in

6.5.6, 7.4.3

HTTP Proxy header vulnerability

Affected

>=6 <6.2.1 · >=4.0.0-rc2 <4.2.4 · >=5 <5.3.1

Fixed in

4.2.4, 5.3.1, 6.2.1