Vulnerability Name:

CVE-2022-24775 (CCN-222383)

Assigned:2022-03-20
Published:2022-03-20
Updated:2022-03-29
Summary:guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): 
Attack Complexity (AC): 
Privileges Required (PR): 
User Interaction (UI): 
Scope:Scope (S): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): 
Attack Complexity (AC): 
Privileges Required (PR): 
User Interaction (UI): 
Scope:Scope (S): 
Impact Metrics:Confidentiality (C): 
Integrity (I): 
Availibility (A): 
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Data Manipulation
References:Source: MITRE
Type: CNA
CVE-2022-24775

Source: XF
Type: UNKNOWN
guzzle-cve202224775-header-injection(222383)

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc

Source: CCN
Type: PSR-7 GIT Repository
Improper Input Validation in guzzlehttp/psr7

Source: CONFIRM
Type: Third Party Advisory
https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96

Source: CCN
Type: SA-CORE-2022-006
Drupal core - Moderately critical - Third-party libraries

Source: CONFIRM
Type: Patch, Third Party Advisory
https://www.drupal.org/sa-core-2022-006

Vulnerable Configuration:Configuration 1:
  • cpe:/a:drupal:drupal:*:*:*:*:*:*:*:* (Version >= 8.0.0 and < 9.2.16)
  • OR cpe:/a:drupal:drupal:*:*:*:*:*:*:*:* (Version >= 9.3.0 and < 9.3.9)

    • Configuration 2:
  • cpe:/a:guzzlephp:psr-7:*:*:*:*:*:*:*:* (Version < 1.8.4)
  • OR cpe:/a:guzzlephp:psr-7:*:*:*:*:*:*:*:* (Version >= 2.0.0 and < 2.1.1)

    • * Denotes that component is vulnerable
    Vulnerability Name:

    CVE-2022-24775 (CCN-222398)

    Assigned:2022-03-20
    Published:2022-03-20
    Updated:2022-03-20
    Summary:Composer PSR-7 package could allow a remote attacker to bypass security restrictions, caused by improper header parsing. By sending a specially-crafted request, an attacker could exploit this vulnerability to sneak in a new line character and pass untrusted values.
    CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
    6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): 
    Attack Complexity (AC): 
    Privileges Required (PR): 
    User Interaction (UI): 
    Scope:Scope (S): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
    6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
    Exploitability Metrics:Attack Vector (AV): 
    Attack Complexity (AC): 
    Privileges Required (PR): 
    User Interaction (UI): 
    Scope:Scope (S): 
    Impact Metrics:Confidentiality (C): 
    Integrity (I): 
    Availibility (A): 
    CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Authentication (Au): None
    Impact Metrics:Confidentiality (C): None
    Integrity (I): Partial
    Availibility (A): None
    7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
    Exploitability Metrics:Access Vector (AV): Network
    Access Complexity (AC): Low
    Athentication (Au): None
    Impact Metrics:Confidentiality (C): None
    Integrity (I): Complete
    Availibility (A): None
    Vulnerability Consequences:Bypass Security
    References:Source: MITRE
    Type: CNA
    CVE-2022-24775

    Source: XF
    Type: UNKNOWN
    composer-cve202224775-sec-bypass(222398)

    Source: CCN
    Type: Composer PSR-7 package GIT Repository
    Improper Input Validation in guzzlehttp/psr7

    BACK
    drupal drupal *
    drupal drupal *
    guzzlephp psr-7 *
    guzzlephp psr-7 *