PT-2022-28159 · Guzzle+3 · Guzzlehttp/Psr7+3

Grahamcampbell + 2 · Published 2022-03-25 · Updated 2024-08-20 · CVE-2023-29197

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions guzzlehttp/psr7 versions prior to 1.9.1 guzzlehttp/psr7 versions prior to 2.4.5

Description The issue concerns improper header parsing, allowing an attacker to sneak in a newline ( ) into both the header names and values. Many servers will also accept `

to terminate the header list, which is not in line with the specification that statesr r ` should be used. This could potentially lead to application errors or invalid HTTP requests being sent out, possibly causing a denial of service vector if a remote service's web application firewall bans the application due to the receipt of malformed requests.

Recommendations For guzzlehttp/psr7 versions prior to 1.9.1, upgrade to version 1.9.1 or later. For guzzlehttp/psr7 versions prior to 2.4.5, upgrade to version 2.4.5 or later. As a temporary workaround, consider validating HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before processing.

Exploit

Fix

RCE

Weakness Enumeration

CWE-436

CWE-20

Related Identifiers

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-DRUPAL-2022-24775

CVE-2023-29197

DLA-3705-1

GHSA-9JXR-MWPP-W643

GHSA-Q7RV-6HP3-VH96

GHSA-WJFC-PGFP-PV9C

GHSA-WXMH-65F7-JCVW

GHSA-XV3H-4844-9H36

MGASA-2023-0241

USN-6670-1

USN-6671-1

Affected Products

Alt Linux

Linuxmint

Ubuntu

Guzzlehttp/Psr7

References · 55

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29197.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml · Exploit
• https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24775 · Security Note
• https://ubuntu.com/security/CVE-2023-29197 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-drupal-2022-24775 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29197 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-29197 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxmh-65f7-jcvw · Vendor Advisory
• https://osv.dev/vulnerability/USN-6671-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-29197 · Vendor Advisory