PT-2022-7278 · Guzzle+2 · Guzzlehttp/Psr7+2

Damien Mckenna + 1 · Published 2022-02-10 · Updated 2024-03-06 · CVE-2022-24775

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions guzzlehttp/psr7 versions prior to 1.8.4 and 2.1.1

Description The issue is related to improper header parsing in the guzzlehttp/psr7 library. An attacker could sneak in a new line character and pass untrusted values in both the header names and values. This could potentially allow a remote attacker to impact the integrity of protected information.

Recommendations For versions prior to 1.8.4, update to version 1.8.4 or later. For versions prior to 2.1.1, update to version 2.1.1 or later. As a temporary workaround, consider validating HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling withHeader().

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-436

Related Identifiers

BDU:2024-01894

BIT-DRUPAL-2022-24775

CVE-2022-24775

DLA-3705-1

DRUPAL-CORE-2022-006

GHSA-Q7RV-6HP3-VH96

GHSA-WXMH-65F7-JCVW

GHSA-XV3H-4844-9H36

USN-6670-1

Affected Products

Linuxmint

Ubuntu

Guzzlehttp/Psr7

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24775.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml · Exploit
• https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc · Patch
• https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29197 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29530 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24775 · Security Note
• https://osv.dev/vulnerability/GHSA-wxmh-65f7-jcvw · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3705-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01894 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24775 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24775 · Vendor Advisory