Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

zendframework/zend-json

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8PackagistPublished

    Zend-JSON vulnerable to XXE/XEE attacks

    GHSA-8x2v-pcg7-94f4

    Affected
    • Packagist zendframework/zend-json >= 2.1.0, < 2.1.6; >= 2.2.0, < 2.2.6
    Fixed in
    2.2.62.1.6· Vendor fix available
    Issue
    Numerous components utilizing PHP's DOMDocument, SimpleXML, and xmlparse functionality are vulnerable to two types of attacks: - XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections. - XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

    Recommended action: Upgrade to 2.2.6 or 2.1.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →