Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-67339 →

DEBIAN-CVE-2026-67339

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capt...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 guzzle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 guzzle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 guzzle

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.2-1"}]}]

Références

advisory security-tracker.debian.org