Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

mezzio/mezzio-swoole

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    mezzio-swoole Applications Using Diactoros Vulnerable to HTTP Host Header Attack

    GHSA-c8rp-cgf4-937w

    Affected
    • Packagist mezzio/mezzio-swoole < 3.7.0; >= 4.0.0, < 4.3.0
    Fixed in
    4.3.03.7.0· Vendor fix available
    Issue
    Impact mezzio-swoole applications using Diactoros for their PSR-7 implementation, and which are either not behind a proxy, or can be accessed via untrusted proxies, can potentially have the host, protocol, and/or port of a Laminas\Diactoros\Uri instance associated with the incoming server request modified to reflect values from X-Forwarded- headers. Such changes can potentially lead to XSS attacks (if a fully-qualified URL is used in links) and/or URL poisoning. Patches 3.7.0, and 4.3.0 and later. The patches present in these versions update the SwooleServerRequestFactory to filter out X-Forwarded- headers when creating the initial request. They then by default pass that instance through a Laminas\Diactoros\ServerRequestFilter\FilterUsingXForwardedHeaders instance created from the trustReservedSubnet() constructor, ensuring that the request only honors the X-Forwarded- headers for private reserved subnets. Users can define the…

    Recommended action: Upgrade to 4.3.0 or 3.7.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →