Guzzle vulnerabilities

Guzzle, an extensible PHP HTTP client, prior to versions 7.15.2 and 8.0.1, has a vulnerability due to discrepancy between Guzzle's URI parsing and libcurl's. An attacker influencing the request URI can bypass application checks and access hosts that should be blocked. Fixed in versions 7.15.2 and 8.0.1.

Guzzle prior to versions 7.15.2 and 8.0.1 contains a vulnerability in the SetCookie::matchesDomain() method that incorrectly recognizes domains in hexadecimal or mixed-base forms (e.g., 0x7f000001) as IP addresses. Cookies set for such domains may be sent to other hosts, leading to disclosure of session identifiers or tokens.

In the Guzzle PHP HTTP client library prior to version 7.12.3, a vulnerability was found in the CookieJar class. The SetCookie::matchesDomain() method incorrectly handled IP addresses (e.g., 192.168.0.1, [::1]) and bare numeric values as domains by applying ordinary suffix matching, allowing cross-host cookie disclosure, cookie injection, or session fixation.