p PatchFirst

GHSA-mg7h-9qfx-4r83

GHSA-mg7h-9qfx-4r83 · ZendFramework Potential Proxy Injection Vulnerabilities

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

`Zend\Session\Validator\RemoteAddr` and `Zend\View\Helper\ServerUrl` were found to be improperly parsing HTTP headers for proxy information, which could potentially allow an attacker to spoof a proxied IP or host name. In `Zend\Session\Validator\RemoteAddr`, if the client is behind a proxy server, the detection of the proxy URL was incorrect, and could lead to invalid results on subsequent lookups. In `Zend\View\Helper\ServerUrl`, if the server lives behind a proxy, the helper would always generate a URL based on the proxy host, regardless of whether or not this was desired; additionally, it did not take into account the proxy port or protocol, if provided.

CVSS 5.9 · Mittel · Korrektur verfügbar

Veröffentlicht
Aktualisiert

Technologie-Stack: php

Betroffene Produkte und Versionen

  • zendframework/zendframework Packagist

    Softwareversionen
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    Betroffene Versionsbereiche
    • ECOSYSTEM: ≥ 2.0.0, < 2.0.5

    Auf 2.0.5 aktualisieren

Originalquellen

Prüfen Sie Ihren Server →