要点
- CVE-2023-29197 は guzzlehttp/psr7, psr-7 (guzzlephp) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.2%（全脆弱性の 68.6% より高い）。
- 対処：2.4.5, 1.9.1 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| guzzlehttp/psr7 Packagist | ≥ 2.0.0, < 2.4.5< 1.9.1
| 2.4.51.9.1
|
| psr-7 | ≥ 2.0.0, < 2.4.5< 1.9.1
| 2.4.51.9.1
|
概要
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.9.1 and 2.4.5.
Workarounds
There are no known workarounds.
References
NVD の説明
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン