CVE-2023-29197: Improper header validation
Impact
Improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n.
Patches
The issue is patched in 1.9.1 and 2.4.5.
Workarounds
There are no known workarounds.
References
https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Other sources
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/guzzlehttp/psr7to a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
composer/guzzlehttp/psr7to a version that resolves this vulnerability.Fixed in 1.9.1 - Upgrade
Upgrade
ubuntu/php-guzzlehttp-psr7to a version that resolves this vulnerability.Fixed in 1.4.2-0.1+ - Upgrade
Upgrade
ubuntu/php-guzzlehttp-psr7to a version that resolves this vulnerability.Fixed in 1.8.3-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/php-guzzlehttp-psr7to a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
ubuntu/php-nyholm-psr7to a version that resolves this vulnerability.Fixed in 1.5.0-1ubuntu0.1~ - Upgrade
Upgrade
ubuntu/php-nyholm-psr7to a version that resolves this vulnerability.Fixed in 1.6.1 - Upgrade
Upgrade
debian/php-guzzlehttp-psr7to a version that resolves this vulnerability.Fixed in 1.7.0-1+deb11u2Fixed in 2.4.5-1Fixed in 2.6.2-3 - Upgrade
Upgrade
debian/php-nyholm-psr7to a version that resolves this vulnerability.Fixed in 1.3.2-2+deb11u1Fixed in 1.5.1-2Fixed in 1.8.1-2 - Upgrade
Upgrade
guzzlehttp/psr7to a version that resolves this vulnerability.Fixed in 1.9.1 - Upgrade
Upgrade
guzzlehttp/psr7to a version that resolves this vulnerability.Fixed in 2.4.5
Event History
Frequently Asked Questions
What is CVE-2023-29197?
CVE-2023-29197 is a vulnerability in the guzzlehttp/psr7 library that allows for improper header validation, potentially enabling an attacker to inject malicious content into HTTP headers.
How does CVE-2023-29197 impact the guzzlehttp/psr7 library?
CVE-2023-29197 affects versions up to 2.4.5 and 1.9.1 of the guzzlehttp/psr7 library, allowing for improper parsing of newline characters in header names and values.
What is the severity of CVE-2023-29197?
CVE-2023-29197 has a severity rating of 7.5, which is classified as high.
How can I fix CVE-2023-29197 in my application?
To fix CVE-2023-29197, update the guzzlehttp/psr7 library to version 2.4.6 or higher.
Are there any references about CVE-2023-29197?
Yes, you can find more information about CVE-2023-29197 at the following references: - Advisory: https://github.com/guzzle/psr7/security/advisories/GHSA-wxmh-65f7-jcvw - CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24775 - Advisory: https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96