Improper header name validation in guzzlehttp/psr7
Summary
Improper header name validation in guzzlehttp/psr7
Original description
The description as published by the source.
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-29197 php-guzzlehttp-psr7 Fixed in: 1.7.0-1+deb11u2
References
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web cve.mitre.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web rfc-editor.org