Improper Input Validation in guzzlehttp/psr7

높음 7.5CVE-2022-24775 · BIT-drupal-2022-24775 · DRUPAL-CORE-2022-006 · Published 21/03/2022 · updated 17/06/2026

요약

CVE-2022-24775은(는) drupal/core, guzzlehttp/psr7, drupal (drupal)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.5%, 전체 취약점의 84.6%보다 높음.
조치: 9.2.16, 9.3.9, 2.1.1, 1.8.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
drupal/core Packagist	`≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9`	`9.2.169.3.9`
guzzlehttp/psr7 Packagist	`≥ 2.0.0, < 2.1.1< 1.8.4`	`2.1.11.8.4`
drupal drupal	`≥ 8.0.0, < 9.2.16≥ 9.3.0, < 9.3.9`	`9.2.169.3.9`
psr-7 guzzlephp	`≥ 2.0.0, < 2.1.1< 1.8.4`	`2.1.11.8.4`

Description

Impact

Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.

Patches

The issue is patched in 1.8.4 and 2.1.1.

Workarounds

There are no known workarounds.

References

https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4

NVD description

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.