GHSA-gcfg-hmwx-wq5h
GHSA-gcfg-hmwx-wq5h · Httpful is Missing Certificate Validation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation
CVSS 9.1 · Critical · Fix available
- Published
- Updated
Stack: php
Affected products and versions
nategood/httpful Packagist
- Versions
- 0.1.0
- 0.1.2
- 0.1.4
- 0.1.5
- 0.1.6
- 0.1.7
- 0.2.0
- 0.2.1
- 0.2.10
- 0.2.11
- 0.2.13
- 0.2.16
- 0.2.17
- 0.2.19
- 0.2.2
- 0.2.20
- 0.2.3
- 0.2.5
- 0.2.6
- 0.2.7
- 0.2.8
- 0.2.9
- 0.3.0
- 0.3.2
- Affected ranges
- ECOSYSTEM: < 1.0.0
Update to 1.0.0
Original sources
- https://github.com/nategood/httpful/issues/247
- https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84
- https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml
- https://github.com/nategood/httpful
- https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35
- https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb
- https://osv.dev/vulnerability/GHSA-gcfg-hmwx-wq5h