HTTP Multiline Header Termination

🗓️ 24 Apr 2023 22:42:39Reported by GitHub Advisory DatabaseType

Laminas Diactoros accepts single line feed character at the end of a header name, causing syntactically invalid messages and potential denial of service

Reporter	Title	Published	Views	Family All 22
Circl	CVE-2023-29530	25 Apr 202300:19	–	circl
CNNVD	Laminas Project diactoros 输入验证错误漏洞	24 Apr 202300:00	–	cnnvd
CVE	CVE-2023-29530	24 Apr 202319:34	–	cve
Cvelist	CVE-2023-29530 Laminas Diactoros vulnerable to HTTP Multiline Header Termination	24 Apr 202319:34	–	cvelist
EUVD	EUVD-2023-1431	3 Oct 202520:07	–	euvd
Fedora	[SECURITY] Fedora 38 Update: php-laminas-diactoros2-2.25.2-1.fc38	28 Apr 202302:37	–	fedora
Tenable Nessus	Fedora 38 : php-laminas-diactoros2 (2023-8cf8786a16)	28 Apr 202300:00	–	nessus
Laminas	HTTP Multiline Header Termination Vulnerability	17 Apr 202317:00	–	laminas
Mend	CVE-2023-29530	24 Apr 202319:34	–	mend
NVD	CVE-2023-29530	24 Apr 202320:15	–	nvd

Vulners

Node

laminas laminas-diactorosRange2.25.0–2.25.2composer

laminas laminas-diactorosRange2.24.0–2.24.2composer

laminas laminas-diactorosMatch2.23.0composer

laminas laminas-diactorosMatch2.22.0composer

laminas laminas-diactorosMatch2.21.0composer

laminas laminas-diactorosMatch2.20.0composer

laminas laminas-diactorosMatch2.19.0composer

laminas laminas-diactorosRange<2.18.1composer

Source	Link
github	www.github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-29530
github	www.github.com/laminas/laminas-diactoros/commit/7e721a60a09c5119c98694c2d23fc031094e1f1c
github	www.github.com/advisories/GHSA-wxmh-65f7-jcvw
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/BPW54QK7ISDALPLP2CKODU4ZIVRYS336/
github	www.github.com/advisories/GHSA-xv3h-4844-9h36

04 Nov 2023 05:07Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5 - 7.5

EPSS0.00965

SSVC

CWE-20