Improper input validation in Getlaminas Laminas-Diactoros
CVE-2023-29530
Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.010 (60.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Getlaminas Laminas-Diactoros — versions 2.19.0, 2.20.0, 2.21.0
- Guzzlephp Psr-7
- Laminas Laminas-Diactoros — versions < 2.18.1, = 2.19.0, = 2.20.0
- Fedoraproject Fedora — versions 38
Weakness classification (CWE)
References
- github.com/laminas/laminas-diactoros/security/advisories/GHSA-xv3h-4844-9h36 (Vendor Advisory)
- github.com/advisories/GHSA-wxmh-65f7-jcvw (Not Applicable)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-29530?
- CVE-2023-29530 is a high-severity vulnerability in Getlaminas Laminas-Diactoros, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2023-04-24.
- How severe is CVE-2023-29530?
- High severity. CVSS v3 base score is 7.5 out of 10.