p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de laminas/laminas-diactoros

Vulnerabilidades publicadas para laminas/laminas-diactoros en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 2

  1. CVE-2023-29530

    Alta · CVSS 7.5EPSS 0,97%Corrección disponible

    Laminas Diactoros vulnerable to HTTP Multiline Header Termination

    Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.24.0, and 2.25.0, users who create HTTP requests or responses using laminas/laminas-diactoros, when providing a newline at the start or end of a header key or value, can cause an invalid message. This can lead to denial of service vectors or application errors. The problem has been patched in following versions 2.18.1, 2.19.1, 2.20.1, 2.21.1, 2.22.1, 2.23.1, 2.24.1, and 2.25.1. As a workaround, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailin

    laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactoros laminas/laminas-diactorosPHP
    • Actualiza a 2.18.1
    • Actualiza a 2.19.1
    • Actualiza a 2.20.1
    • Actualiza a 2.21.1
    • Actualiza a 2.22.1
    • Actualiza a 2.23.1
    • Actualiza a 2.24.2
    • Actualiza a 2.25.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2022-31109

    Alta · CVSS 7.2EPSS 0,8%Corrección disponible

    HTTP Host Header Attack Vulnerability in laminas-diactoros

    laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a `Laminas\Diactoros\Uri` instance associated with the incoming server request modified to reflect values from `X-Forwarded-*` headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Since the `X-Forwarded-*` headers do have valid use cases, particularly in clustered envir

    laminas/laminas-diactorosPHP
    • Actualiza a 2.11.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →