Zendframework vulnerable to XXE/XEE attacks

緊急 9.8GHSA-qc7w-4567-84wv · 07/06/2024 公開 · 04/12/2024 更新

要点

GHSA-qc7w-4567-84wv は zendframework/zendframework に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
対処：2.1.6, 2.2.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
zendframework/zendframework Packagist	`≥ 2.1.0, < 2.1.6≥ 2.2.0, < 2.2.6`	`2.1.62.2.6`

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

Packagist

≥ 2.1.0, < 2.1.6≥ 2.2.0, < 2.2.6

2.1.62.2.6

概要

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

zendframework/zendframework のその他の脆弱性

すべて見る →