Improper header name validation in guzzlehttp/psr7

🗓️ 19 Apr 2023 18:25:53Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 111 Views

Improper header name validation in guzzlehttp/psr7. Header parsing vulnerability patched in version 1.9.1 and 2.4.

Reporter	Title	Published	Views	Family All 103
FreeBSD	mantis -- multiple vulnerabilities	14 Oct 202300:00	–	freebsd
FreeBSD	mediawiki -- multiple vulnerabilities	21 Apr 202300:00	–	freebsd
Circl	CVE-2023-29197	27 Oct 202317:00	–	circl
CNNVD	PSR-7 Message Implementation 安全漏洞	17 Apr 202300:00	–	cnnvd
CVE	CVE-2023-29197	17 Apr 202321:08	–	cve
Cvelist	CVE-2023-29197 Improper header name validation in guzzlehttp/psr7	17 Apr 202321:08	–	cvelist
Debian	[SECURITY] [DLA 3705-1] php-guzzlehttp-psr7 security update	31 Dec 202322:52	–	debian
Debian CVE	CVE-2023-29197	17 Apr 202321:08	–	debiancve
Tenable Nessus	Debian dla-3705 : php-guzzlehttp-psr7 - security update	22 Jan 202500:00	–	nessus
Tenable Nessus	Fedora 38 : php-nyholm-psr7 (2023-b0811dc6e4)	29 Apr 202300:00	–	nessus

Vulners

Node

guzzlehttp psr7Range2.0.0–2.4.5composer

guzzlehttp psr7Range<1.9.1composer

Source	Link
github	www.github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
github	www.github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-29197
rfc-editor	www.rfc-editor.org/rfc/rfc7230
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2023-29197.yaml
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/
lists	www.lists.debian.org/debian-lts-announce/2023/12/msg00028.html
github	www.github.com/advisories/GHSA-wxmh-65f7-jcvw

09 Jan 2024 05:05Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.3 - 7.5

EPSS0.01216