GitHub Advisoryadvisory · Packagist

GHSA-8jp9-mpv9-98rj amphp/http-client Header leakage on cross-domain redirects

MEDIUM Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: amphp/http-client
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Reviewed: 2024-05-15

Affected packages

• Packagist amphp/http-client: >= 4.0.0, < 4.4.0 → fixed in 4.4.0

Description

amphp/http-client has a security weakness that might leak sensitive request headers from the initial request to the redirected host on cross-domain redirects, which were not removed correctly. `Message::setHeaders` does not replace the entire set of headers, but only operates on the headers matching the given array keys.

References

https://github.com/amphp/http-client/commit/fa7925363e6d5a0d0d337e2e6eb1affb93cf226e web
https://github.com/FriendsOfPHP/security-advisories/blob/master/amphp/http-client/2020-06-16.yaml web
https://github.com/amphp/http-client package
https://github.com/amphp/http-client/releases/tag/v4.4.0 web