CVE-2023-29530
published 2023-04-24CVE-2023-29530: Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.97%
57.7th percentile
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| getlaminas | laminas-diactoros | < 2.18.1 | 2.18.1 |
| getlaminas | laminas-diactoros | — | — |
| getlaminas | laminas-diactoros | — | — |
| getlaminas | laminas-diactoros | — | — |
| getlaminas | laminas-diactoros | — | — |
| getlaminas | laminas-diactoros | — | — |
| getlaminas | laminas-diactoros | — | — |
| getlaminas | laminas-diactoros | — | — |
| guzzlephp | psr-7 | < 1.9.1 | 1.9.1 |
| guzzlephp | psr-7 | >= 2.0.0 < 2.4.5 | 2.4.5 |
| laminas | laminas-diactoros | < 2.18.1 | 2.18.1 |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | — | — |
| laminas | laminas-diactoros | >= 0 < 2.18.1 | 2.18.1 |
| laminas | laminas-diactoros | >= 2.19.0 < 2.19.1 | 2.19.1 |
| laminas | laminas-diactoros | >= 2.20.0 < 2.20.1 | 2.20.1 |
| laminas | laminas-diactoros | >= 2.21.0 < 2.21.1 | 2.21.1 |
| laminas | laminas-diactoros | >= 2.22.0 < 2.22.1 | 2.22.1 |
| laminas | laminas-diactoros | >= 2.23.0 < 2.23.1 | 2.23.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
HTTP Multiline Header Termination
ghsa·2023-04-24·CVSS 7.5
CVE-2023-29530 [HIGH] CWE-20 HTTP Multiline Header Termination
HTTP Multiline Header Termination
### Impact
Affected versions of Laminas Diactoros accepted a single line feed (LF / `\n` ) character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due to the header line being terminated too early. An attacker that is able to control the header names that are passed to Laminas Diactoros would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
OSV
HTTP Multiline Header Termination
osv·2023-04-24·CVSS 7.5
CVE-2023-29530 [HIGH] HTTP Multiline Header Termination
HTTP Multiline Header Termination
### Impact
Affected versions of Laminas Diactoros accepted a single line feed (LF / `\n` ) character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due to the header line being terminated too early. An attacker that is able to control the header names that are passed to Laminas Diactoros would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
GHSA
Insecure header validation in slim/psr7
ghsa·2023-04-18·CVSS 7.5
CVE-2023-30536 [HIGH] CWE-436 Insecure header validation in slim/psr7
Insecure header validation in slim/psr7
### Impact
An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
### Patches
The issue is patched in 1.6.1, 1.5.1, and 1.4.1.
### Workarounds
In Slim-Psr7 prior to 1.6.1, 1.5.1, and 1.4.
OSV
Insecure header validation in slim/psr7
osv·2023-04-18·CVSS 7.5
CVE-2023-30536 [HIGH] Insecure header validation in slim/psr7
Insecure header validation in slim/psr7
### Impact
An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.
### Patches
The issue is patched in 1.6.1, 1.5.1, and 1.4.1.
### Workarounds
In Slim-Psr7 prior to 1.6.1, 1.5.1, and 1.4.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/advisories/GHSA-wxmh-65f7-jcvwhttps://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36https://lists.fedoraproject.org/archives/list/[email protected]/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/https://github.com/advisories/GHSA-wxmh-65f7-jcvwhttps://github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36https://lists.fedoraproject.org/archives/list/[email protected]/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/
2023-04-24
Published