CVE-2023-29197

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-29197
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 Not Applicable
https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 Not Applicable
https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ Mailing List Third Party Advisory
https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 Technical Description
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 Not Applicable
https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 Not Applicable
https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ Mailing List Third Party Advisory
https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 Technical Description
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*
cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
History

21 Nov 2024, 07:56

Type Values Removed Values Added
References () https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 - Not Applicable () https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 - Not Applicable
References () https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 - Not Applicable () https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 - Not Applicable
References () https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw - Vendor Advisory () https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw - Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html - () https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html -
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ - Mailing List, Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ - Mailing List, Third Party Advisory
References () https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 - Technical Description () https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 - Technical Description
CVSS v2 : unknown
v3 : 7.5 		v2 : unknown
v3 : 5.3

01 Jan 2024, 01:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html -

03 May 2023, 18:12

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 - (MISC) https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96 - Not Applicable
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ - Mailing List, Third Party Advisory
References (MISC) https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 - (MISC) https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4 - Technical Description
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ - Mailing List, Third Party Advisory
References (MISC) https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 - (MISC) https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 - Not Applicable
References (MISC) https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw - (MISC) https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw - Vendor Advisory
CPE cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:a:guzzlephp:psr-7:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

29 Apr 2023, 05:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FJANWDXJZE5BGLN4MQ4FEHV5LJ6CMKQF/ -

28 Apr 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O35UN4IK6VS2LXSRWUDFWY7NI73RKY2U/ -

18 Apr 2023, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-17 22:15

Updated : 2024-11-21 07:56

NVD link : CVE-2023-29197

Mitre link : CVE-2023-29197

CVE.ORG link : CVE-2023-29197

JSON object : View

Products Affected

fedoraproject

  • fedora

guzzlephp

  • psr-7
CWE
CWE-436

Interpretation Conflict