CVE-2023-29197 Improper header name validation in guzzlehttp/psr7

2023-04-1721:08:46

CWE-436

GitHub_M

www.cve.org

cve-2023-29197

improper header parsing

php

security vulnerability

http message library

newline injection

patch

upgrade

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.6%

JSON

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

CNA Affected

[
  {
    "vendor": "guzzle",
    "product": "psr7",
    "versions": [
      {
        "version": "< 1.9.1",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.4.5",
        "status": "affected"
      }
    ]
  }
]