Описание
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| php-guzzlehttp-psr7 | fixed | 1.8.5-1 | package | |
| php-guzzlehttp-psr7 | fixed | 1.7.0-1+deb11u1 | bullseye | package |
| php-guzzlehttp-psr7 | fixed | 1.4.2-0.1+deb10u1 | buster | package |
Примечания
https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
EPSS
Связанные уязвимости
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Уязвимость библиотеки обработки HTTP-сообщений PSR-7 guzzlehttp/psr7, связанная с недостаточной проверкой входных данных, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
EPSS