CVE-2021-29476
published 2021-04-27CVE-2021-29476: Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0…
PriorityP278critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.14%
79.8th percentile
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 5.5.3+dfsg1-1 (bookworm) | wordpress 5.5.3+dfsg1-1 (bookworm) |
| rmccue | requests | >= 1.6.0 < 1.8.0 | 1.8.0 |
| wordpress | requests | — | — |
| wordpress | requests | — | — |
| wordpress | requests | — | — |
| wordpress | requests | — | — |
| wordpress | wordpress | >= 0 < 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
| wordpress | wordpress | >= 0 < 5.5.3+dfsg1-1 | 5.5.3+dfsg1-1 |
Detection & IOCsextracted from sources · hover to see the quote
- ·Vulnerability affects Requests PHP library versions 1.6.0, 1.6.1, and 1.7.0 due to mishandling of deserialization in FilteredIterator; fixed in version 1.8.0. ↗
- ·Debian packages resolved the issue in version 5.5.3+dfsg1-1 across bookworm, bullseye, forky, sid, and trixie. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vulncheck9.8CRITICAL
vendor_debian9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Insecure Deserialization of untrusted data in rmccue/requests
ghsa·2021-04-29·CVSS 9.8
CVE-2021-29476 [CRITICAL] CWE-502 Insecure Deserialization of untrusted data in rmccue/requests
Insecure Deserialization of untrusted data in rmccue/requests
### Impact
Unserialization of untrusted data.
### Patches
The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
### References
Publications about the vulnerability:
* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
* https://github.com/ambionics/phpggc/issues/52
* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
* https://2018.zeronights.ru/wp-content/upl
OSV
Insecure Deserialization of untrusted data in rmccue/requests
osv·2021-04-29·CVSS 9.8
CVE-2021-29476 [CRITICAL] Insecure Deserialization of untrusted data in rmccue/requests
Insecure Deserialization of untrusted data in rmccue/requests
### Impact
Unserialization of untrusted data.
### Patches
The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
### References
Publications about the vulnerability:
* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
* https://github.com/ambionics/phpggc/issues/52
* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
* https://2018.zeronights.ru/wp-content/upl
OSV
CVE-2021-29476: Requests is a HTTP library written in PHP
osv·2021-04-27·CVSS 9.8
CVE-2021-29476 [CRITICAL] CVE-2021-29476: Requests is a HTTP library written in PHP
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
VulnCheck
WordPress requests Deserialization of Untrusted Data
vulncheck·2021·CVSS 9.8
CVE-2021-29476 [CRITICAL] WordPress requests Deserialization of Untrusted Data
WordPress requests Deserialization of Untrusted Data
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
Affected: WordPress requests
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-553-php-object-injection-gadget?asset_slug=wordpress
Debian
CVE-2021-29476: wordpress - Requests is a HTTP library written in PHP. Requests mishandles deserialization i...
vendor_debian·2021·CVSS 9.8
CVE-2021-29476 [CRITICAL] CVE-2021-29476: wordpress - Requests is a HTTP library written in PHP. Requests mishandles deserialization i...
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
Scope: local
bookworm: resolved (fixed in 5.5.3+dfsg1-1)
bullseye: resolved (fixed in 5.5.3+dfsg1-1)
forky: resolved (fixed in 5.5.3+dfsg1-1)
sid: resolved (fixed in 5.5.3+dfsg1-1)
trixie: resolved (fixed in 5.5.3+dfsg1-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-04-27
Published
Exploited in the wild