GitHub Advisoryadvisory · Packagist

GHSA-wxmh-65f7-jcvw Improper header name validation in guzzlehttp/psr7

MEDIUM Published 2023-04-19 Modified 2023-04-19 Official page ↗
Aliases
CVE-2023-29197
Ecosystem
Packagist
Packages
guzzlehttp/psr7
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-436
Reviewed
2023-04-19

Affected packages

• Packagist guzzlehttp/psr7: < 1.9.1 → fixed in 1.9.1 • Packagist guzzlehttp/psr7: >= 2.0.0, < 2.4.5 → fixed in 2.4.5

Description

Impact Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. Patches The issue is patched in 1.9.1 and 2.4.5. Workarounds There are no known workarounds. References • https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4

Related

Alias · CVE (1)

  • CVE-2023-29197 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. vulnerability

Weakness · CWE (1)

  • CWE-436 Interpretation Conflict weakness

References