Bug #97759: Update vulnerable guzzlehttp/guzzle version - TYPO3 Core - TYPO3 Forge

Actions

Bug #97759

closed

Status:

Closed

Priority:

Should have

Assignee:

Category:

Target version:

Start date:

2022-06-12

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

PHP Version:

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

guzzlehttp/guzzle must be updated to version 6.5.7 and 7.4.4 which fixes the following security vulnerabilities:

Failure to strip the Cookie header on change in host or HTTP downgrade
https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9

Since TYPO3 is not affected by the vulnerabilities by default, the update is handled in public.

Actions

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74876

Actions

Patch set 1 for branch 11.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74878

Actions

Patch set 1 for branch 10.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/74879

Actions