Kurz gesagt
- CVE-2022-24775 ist eine Schwachstelle (HOCH (CVSS 7.5)) in drupal/core, guzzlehttp/psr7, drupal (drupal).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.5%, höher als bei 84.6% aller Schwachstellen.
- Abhilfe: auf 9.2.16, 9.3.9, 2.1.1, 1.8.4 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| drupal/core Packagist | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| guzzlehttp/psr7 Packagist | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
| drupal | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| psr-7 | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
Description
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
NVD description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free