GHSA-gcfg-hmwx-wq5h
GHSA-gcfg-hmwx-wq5h · Httpful is Missing Certificate Validation
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation
CVSS 9.1 · Crítica · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
nategood/httpful Packagist
- Versiones
- 0.1.0
- 0.1.2
- 0.1.4
- 0.1.5
- 0.1.6
- 0.1.7
- 0.2.0
- 0.2.1
- 0.2.10
- 0.2.11
- 0.2.13
- 0.2.16
- 0.2.17
- 0.2.19
- 0.2.2
- 0.2.20
- 0.2.3
- 0.2.5
- 0.2.6
- 0.2.7
- 0.2.8
- 0.2.9
- 0.3.0
- 0.3.2
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.0.0
Actualiza a 1.0.0
Fuentes originales
- https://github.com/nategood/httpful/issues/247
- https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84
- https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml
- https://github.com/nategood/httpful
- https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35
- https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb
- https://osv.dev/vulnerability/GHSA-gcfg-hmwx-wq5h