CVE-2023-29197

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Interpretation Conflict pada guzzlephp psr-7, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Rincian

Terbit di NVD

17 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-436: Interpretation Conflict

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw advisory vendor
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXS... mailing list · advisory pihak ketiga
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 not applicable
• https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 not applicable
• https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html
• https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 deskripsi teknis