Vulnerability Description
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Guzzlephp | Psr-7 | < 1.9.1 |
| Fedoraproject | Fedora | 37 |
Related Weaknesses (CWE)
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775Not Applicable
- https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96Not Applicable
- https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvwVendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4Technical Description
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775Not Applicable
- https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96Not Applicable
- https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvwVendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00028.html
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]Mailing ListThird Party Advisory
- https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4Technical Description
FAQ
What is CVE-2023-29197?
CVE-2023-29197 is a vulnerability with a CVSS score of 5.3 (MEDIUM). guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names an...
How severe is CVE-2023-29197?
CVE-2023-29197 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-29197?
Check the references section above for vendor advisories and patch information. Affected products include: Guzzlephp Psr-7, Fedoraproject Fedora.