CVE-2023-29197

2023-04-1722:15:09

CWE-436

[email protected]

web.nvd.nist.gov

guzzlehttp/psr7

vulnerability

improper header parsing

newline injection

php

http message library

cve-2023-29197

fix

upgrade

incomplete fix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

69.9%

JSON

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Affected configurations

Nvd

Node

guzzlephppsr-7Range<1.9.1

guzzlephppsr-7Range2.0.0–2.4.5

Node

fedoraprojectfedoraMatch37

fedoraprojectfedoraMatch38

VendorProductVersionCPE
guzzlephppsr-7*cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
fedoraprojectfedora38cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
guzzlephp	psr-7	*	cpe:2.3:a:guzzlephp:psr-7::::::::
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*
fedoraproject	fedora	38	cpe:2.3:o:fedoraproject:fedora:38:::::::*