guzzle: [CVE-2022-29248] Cross-domain cookie leakage

Related Vulnerabilities: CVE-2022-29248  

Debian Bug report logs - #1011636
guzzle: [CVE-2022-29248] Cross-domain cookie leakage

version graph

Reported by: David Prévot <taffit@debian.org>

Date: Wed, 25 May 2022 15:45:02 UTC

Severity: serious

Tags: security, upstream

Found in version guzzle/7.4.1-1

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, team@security.debian.org, Katharina Drexel <katharina.drexel@bfh.ch>:
Bug#1011636; Package php-guzzlehttp-guzzle. (Wed, 25 May 2022 15:45:04 GMT) (full text, mbox, link).


Acknowledgement sent to David Prévot <taffit@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Katharina Drexel <katharina.drexel@bfh.ch>. (Wed, 25 May 2022 15:45:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: David Prévot <taffit@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: guzzle: [CVE-2022-29248] Cross-domain cookie leakage
Date: Wed, 25 May 2022 17:05:37 +0200
[Message part 1 (text/plain, inline)]
Package: php-guzzlehttp-guzzle
Version: 7.4.1-1
Severity: serious
Tags: upstream security
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Guzzle 7.5.0 (and 7.4.3) has just been released fixing a
cross-domain cookie leakage.

More information:

  https://github.com/guzzle/guzzle/security/advisories/GHSA-cwmx-hcrq-mhc3

Regards

David

P.-S. Please, consider maintaining this package within the Debian PHP
PEAR (and Composer) Maintainers <pkg-php-pear@lists.alioth.debian.org>
team.

FYI, I just started documenting our usual workflom.

  https://wiki.debian.org/Teams/DebianPHPGroup/Composer
[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Thu May 26 13:12:24 2022; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.