PT-2023-22303 · Laminas · Laminas Diactoros

Grahamcampbell · Published 2023-04-19 · Updated 2023-05-05 · CVE-2023-29530

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Laminas Diactoros versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0

Description The issue is related to improper header parsing, where an attacker could sneak in a newline into both the header names and values, potentially leading to denial of service vectors or application errors. This can occur when users create HTTP requests or responses using laminas/laminas-diactoros and provide a newline at the start or end of a header key or value, causing an invalid message.

Recommendations For versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, update to the patched versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1 respectively. As a temporary workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling withHeader().

Exploit

Fix

RCE

Weakness Enumeration

CWE-436

CWE-20

Related Identifiers

CVE-2023-29530

GHSA-WXMH-65F7-JCVW

GHSA-XV3H-4844-9H36

Affected Products

Laminas Diactoros

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29530.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml · Exploit
• https://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29530 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xv3h-4844-9h36 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxmh-65f7-jcvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29530 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29197 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U · Vendor Advisory
• https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 · Note
• https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw · Note
• https://github.com/guzzle/psr7 · Note
• https://github.com/laminas/laminas-diactoros/commit/7e721a60a09c5119c98694c2d23fc031094e1f1c · Note