GitHub Advisoryadvisory · Packagist

GHSA-2jx7-xg83-j2m7 Zendframework Denial of Service vector via XEE injection

HIGH Published 2024-06-07 Modified 2024-06-07 Official page ↗
Ecosystem
Packagist
Packages
zendframework/zendframework1
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-776
Reviewed
2024-06-07

Affected packages

• Packagist zendframework/zendframework1: >= 1.0.0, < 1.11.13 → fixed in 1.11.13

Description

`Zend_Dom`, `Zend_Feed`, `Zend_Soap`, and `Zend_XmlRpc` are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

Related

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References