CVE-2022-31033: Authorization header leak in rubygem Mechanize
The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ruby-mechanizeto a version that resolves this vulnerability.Fixed in 2.8.5-1Fixed in 2.10.1-1Fixed in 2.14.2-1 - Upgrade
Upgrade
debian/ruby-mechanizeto a version that resolves this vulnerability.Fixed in 2.8.5-1 - Upgrade
Upgrade
rubygem Mechanizeto a version that resolves this vulnerability.Fixed in 2.8.5
Event History
Frequently Asked Questions
What is CVE-2022-31033?
CVE-2022-31033 is a vulnerability in the Mechanize library that leaks the Authorization header after a redirect to a different port on the same site.
How does CVE-2022-31033 affect the Mechanize library?
CVE-2022-31033 affects versions of the Mechanize library prior to 2.8.5.
What is the severity of CVE-2022-31033?
CVE-2022-31033 has a severity rating of 7.5 (high).
How can I fix CVE-2022-31033?
To fix CVE-2022-31033, update to version 2.8.5 or later of the Mechanize library.
Where can I find more information about CVE-2022-31033?
More information about CVE-2022-31033 can be found in the references provided: [Reference 1](https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317), [Reference 2](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9), [Reference 3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX/)