GitHub Advisoryadvisory · Packagist
GHSA-f57v-q966-7fh6 Monolog Header injection in NativeMailerHandler
LOW
Official page ↗
- Ecosystem
- Packagist
- Packages
- monolog/monolog
- Severity
- Low
- Weaknesses
- CWE-74
- Reviewed
- 2024-05-15
Affected packages
• Packagist monolog/monolog: >= 1.8.0, < 1.12.0 → fixed in 1.12.0
Description
A header injection vulnerability has been identified in the NativeMailerHandler of the Monolog library. This vulnerability may allow an attacker to manipulate email headers when log messages are sent via email.
Related
Weakness · CWE (1)
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
References
- https://github.com/Seldaek/monolog/issues/458 web
- https://github.com/Seldaek/monolog/pull/448#issuecomment-68208704 web
- https://github.com/Seldaek/monolog/commit/515a096c864b00b3967f7f601680f85d4a2e4001 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/monolog/monolog/2014-12-29-1.yaml web
- https://github.com/Seldaek/monolog package