Laminas Project laminas-http - Remote Code Execution

Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...

CVE-2021-3007-docker-poc

CVE-2021-3007 — Laminas/Zend HTTP 反序列化远程代码执行 本仓库包含 CVE-2021-3007 的完整可复现概念验证（PoC）及 Nuclei 利用模板。该漏洞是 Zend\Http\Response\Stream（laminas-http Nuclei 利用模板 ├── docker-compose.yml - 脆弱测试环境 ├── Dockerfile ├── vulnerable-app/ │ ├── index.php - unserialize 脆弱端点 │ └── composer.json - 脆弱依赖 ├── exploit.php -...

zend-crypt

zend-crypt 仓库已于 2019-12-31 弃用 此仓库已迁移至 laminas/laminas-crypt。 Zend\Crypt 提供对多种密码学工具的支持。 其中可用的功能包括： 使用对称密码进行“先加密后认证”（认证步骤 由 HMAC 提供）； 使用对称及公钥算法（如 RSA 算法）进行加密/解密； 使用混合模式（类似 OpenPGP）进行加密/解密； 使用公钥算法（如 RSA 算法）生成数字签名； 使用 Diffie-Hellman 方法进行密钥交换； 密钥派生函数（例如使用 PBKDF2 算法）； 安全密码哈希（例如使用 Bcrypt 算法）； 生成哈希值； 生成...

Exploit for Deserialization of Untrusted Data in Getlaminas Laminas-Http

CVE-2021-3007 Vulnerable Test Environment !Dockerhttps://...

Exploit for Deserialization of Untrusted Data in Getlaminas Laminas-Http

CVE-2021-3007 — Laminas/Zend HTTP Deserialization RCE ==========...

EUVD-2023-1431

Malicious code in bioql PyPI...

EUVD-2022-6288

Malicious code in bioql PyPI...

EUVD-2022-0630

Malicious code in bioql PyPI...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

[SECURITY] Fedora 38 Update: php-laminas-diactoros2-2.25.2-1.fc38

A PHP package containing implementations of the accepted PSR-7 HTTP message interfaces 1, as well as a "server" implementation similar to node's http.Server 2. Documentation: https://docs.laminas.dev/laminas-diactoros/ Autoloader: /usr/share/php/Laminas/Diactoros2/autoload.php 1...

Fedora 38 : php-laminas-diactoros2 (2023-8cf8786a16)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8cf8786a16 advisory. Version 2.25.2 This release provides a patch for CVE-2023-29530 / GHSA-xv3h-4844-9h36 / LP2023-01. Tenable has extracted the preceding description block...

GHSA-XV3H-4844-9H36 HTTP Multiline Header Termination

Impact Affected versions of Laminas Diactoros accepted a single line feed LF / \n character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due ...

HTTP Multiline Header Termination

Impact Affected versions of Laminas Diactoros accepted a single line feed LF / \n character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due ...

CVE-2023-29530

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...

Design/Logic Flaw

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...

CVE-2023-29530 Laminas Diactoros vulnerable to HTTP Multiline Header Termination

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...

CVE-2023-29530

Laminas Diactoros HTTP message implementations are affected in versions up to 2.25.0 by an issue where a leading/trailing newline in a header key or value can produce an invalid HTTP message, potentially enabling DoS or application errors. Patches are available in 2.18.1, 2.19.1, 2.20.1, 2.21.1, ...

CVE-2023-29530 Laminas Diactoros vulnerable to HTTP Multiline Header Termination

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...

CVE-2023-29530 Laminas Diactoros vulnerable to HTTP Multiline Header Termination

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value...

Laminas Project diactoros 输入验证错误漏洞

Laminas Project diactoros is a PSR HTTP message implementation of Laminas Project. An input validation error vulnerability exists in Laminas Project diactoros. An attacker could exploit this vulnerability to cause a denial of service on the system. The following versions are affected: version...