Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Reference: https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q
Created php-guzzlehttp-guzzle tracking bugs for this issue: Affects: epel-7 [bug 2097355] Affects: fedora-all [bug 2097354]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.