En bref
- CVE-2022-24775 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant drupal/core, guzzlehttp/psr7, drupal (drupal).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.5%, plus élevée que 84.6% des vulnérabilités.
- Correctif : mettre à jour vers 9.2.16, 9.3.9, 2.1.1, 1.8.4 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| drupal/core Packagist | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| guzzlehttp/psr7 Packagist | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
| drupal | ≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9
| 9.2.169.3.9
|
| psr-7 | ≥ 2.0.0, < 2.1.1< 1.8.4
| 2.1.11.8.4
|
Description
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
NVD description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free