Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

slim/psr7

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5PackagistPublished

    Insecure header validation in slim/psr7

    CVE-2023-30536 · GHSA-q2qj-628g-vhfw

    Affected
    • Packagist slim/psr7 >= 1.6, < 1.6.1; >= 1.5, < 1.5.1; < 1.4.1
    Fixed in
    1.4.11.6.11.5.1· Vendor fix available
    Issue
    Impact An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests. Patches The issue is patched in 1.6.1, 1.5.1, and 1.4.1. Workarounds In Slim-Psr7 prior to 1.6.1, 1.5.1, and 1.4.1, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling withHeader(). Acknowledgments We are very grateful to and thank <a…

    Recommended action: Upgrade to 1.6.1, 1.5.1 or 1.4.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →