Skip to main content

Interpretation Conflict

CVE-2023-29197

High
7.5/10

Summary

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline ("\n") into both the header names and values. While the specification states that "\r\n\r\n" is used to terminate the header list, many servers in the wild will also accept "\n\n". This is a follow-up to CVE-2022-24775 where the fix was incomplete. There are no known workarounds for this vulnerability. Users are advised to upgrade. This issue affects guzzlehttp/psr7 versions 1.8.4 through 1.9.0 and 2.1.1 through 2.4.4, httpsoft/http-message versions through 1.0.11, and nyholm/psr7 versions through 1.6.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-436 - Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References

Advisory Timeline

  • Published