← Voltar para CVEs
CVE-2023-29197
MEDIUM5.3
Descricao
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Detalhes CVE
Pontuacao CVSS v3.15.3
SeveridadeMEDIUM
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado4/17/2023
Ultima modificacao11/21/2024
Fontenvd
Avistamentos honeypot0
Produtos afetados
fedoraproject:fedoraguzzlephp:psr-7
Fraquezas (CWE)
CWE-436
Referencias
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775(security-advisories@github.com)
https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96(security-advisories@github.com)
https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw(security-advisories@github.com)
https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html(security-advisories@github.com)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/(security-advisories@github.com)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/(security-advisories@github.com)
https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4(security-advisories@github.com)
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96(af854a3a-2127-422b-91ae-364da2661108)
https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/(af854a3a-2127-422b-91ae-364da2661108)
https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4(af854a3a-2127-422b-91ae-364da2661108)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.