CVE-2022-24775: Improper Input Validation in guzzlehttp/psr7
Impact
Improper header parsing. An attacker could sneak in a carriage return character (\r) and pass untrusted values in both the header names and values.
Patches
The issue is patched in 1.8.4 and 2.1.1.
Workarounds
There are no known workarounds.
References
https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Other sources
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
— Ubuntu
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24775?
CVE-2022-24775 is a vulnerability in the guzzlehttp/psr7 library that allows improper parsing of HTTP headers, potentially allowing an attacker to pass untrusted values.
How severe is CVE-2022-24775?
CVE-2022-24775 has a severity rating of 7.5 (High).
Which versions of guzzlehttp/psr7 are affected by CVE-2022-24775?
Versions prior to 1.8.4 and 2.1.1 of guzzlehttp/psr7 are affected by CVE-2022-24775.
How can I fix CVE-2022-24775?
To fix CVE-2022-24775, you should update guzzlehttp/psr7 to version 1.8.4 or 2.1.1, as these versions contain the necessary patches.
Are there any known workarounds for CVE-2022-24775?
There are currently no known workarounds for CVE-2022-24775.