CVE-2022-29248: Exposure of Sensitive Information to an Unauthorized Actor

May 25, 2022 (updated July 21, 2023)

Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites.

References

github.com/guzzle/guzzle/commit/74a8602c6faec9ef74b7a9391ac82c5e65b1cdab
github.com/guzzle/guzzle/pull/3018
github.com/guzzle/guzzle/security/advisories/GHSA-cwmx-hcrq-mhc3
nvd.nist.gov/vuln/detail/CVE-2022-29248
www.drupal.org/sa-core-2022-010

Code Behaviors & Features

Detect and mitigate CVE-2022-29248 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →