p PatchFirst

CVE-2021-29476

CVE-2021-29476 · Insecure Deserialization of untrusted data in rmccue/requests

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

CVSS 9.8 · Critical · EPSS 2.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • requests

    Versions
    • >= 1.6.0, < 1.8.0: Affected

    No fix published

  • wordpress Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.5.3+dfsg1-1

    Update to 5.5.3+dfsg1-1

  • wordpress Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.5.3+dfsg1-1

    Update to 5.5.3+dfsg1-1

  • wordpress Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.5.3+dfsg1-1

    Update to 5.5.3+dfsg1-1

  • rmccue/requests Packagist

    Versions
    • v1.6.0
    • v1.6.1
    • v1.7.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.6.0, < 1.8.0

    Update to 1.8.0

  • wordpress Ubuntu:16.04:LTS

    Versions
    • 4.3+dfsg-1
    • 4.3.1+dfsg-1
    • 4.4+dfsg-1
    • 4.4.1+dfsg-1
    • 4.4.2+dfsg-1
    • 4.4.2+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:18.04:LTS

    Versions
    • 4.8.2+dfsg-2
    • 4.8.3+dfsg-1
    • 4.9.1+dfsg-1
    • 4.9.2+dfsg-1
    • 4.9.4+dfsg-1
    • 4.9.5+dfsg1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wordpress Ubuntu:20.04:LTS

    Versions
    • 5.2.2+dfsg1-1
    • 5.2.4+dfsg1-1
    • 5.3.2+dfsg1-1
    • 5.3.2+dfsg1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →