PT-2024-40416 · Unknown+2 · Zend Framework 2+2

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zend Framework 2 (affected versions not specified)

Description The issue concerns XML Entity Expansion (XEE) attacks, which can lead to Denial Of Service attacks against a host's RAM. This occurs because there is no current method of disabling custom entities in PHP, defined internal to the XML document without using external entities. A long entity can be defined and then referred to multiple times in document elements, creating a memory sink. The use of the LIBXML NOENT or equivalent option can amplify the impact. Additionally, libxml2's innate defense against related Exponential or Billion Laugh's XEE attacks is active only so long as the LIBXML PARSEHUGE is NOT set.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

GHSA-Q2GC-GG3X-7942

Affected Products

Php

Zend Framework 2

Libxml2

References · 6

• https://osv.dev/vulnerability/GHSA-q2gc-gg3x-7942 · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/compare/352e8f583c87c709de197bb16c4053d2e87fd4cd...5bf4f92e86c34690d71e8f94350ec975909a435b.diff · Note
• https://github.com/symfony/symfony/blob/2.0/CHANGELOG-2.0.md · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2012-08-28.yaml · Note
• https://symfony.com/blog/security-release-symfony-2-0-17-released · Note