Improper Input Validation in guzzlehttp/psr7
CVE-2022-24775

7.5HIGH

Key Information:

Vendor: Guzzle
Status: Psr7
Vendor: CVE Published:; 21 March 2022

🔔 Create Guzzle Vulnerability Alert

What is CVE-2022-24775?

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

Affected Version(s)

psr7 < 1.8.4 < 1.8.4

psr7 >= 2.0.0, < 2.1.1 < 2.0.0, 2.1.1

References

https://github.com/guzzle/psr7/security/advisories/GHSA-q...

x_refsource_CONFIRM

https://github.com/guzzle/psr7/pull/485/commits/e55afaa3f...

x_refsource_MISC

https://github.com/guzzle/psr7/pull/486/commits/9a96d9db6...

x_refsource_MISC

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 21, 2022
Vulnerability Reserved
Feb 10, 2022

CVE-2022-24775 Data

.