HIGH7.5

GHSA-2jx7-xg83-j2m7

Zendframework Denial of Service vector via XEE injection

Quick fix

GHSA-2jx7-xg83-j2m7 — zendframework/zendframework1: upgrade to the fixed version with the command below.

composer require zendframework/zendframework1:^1.11.13

Details

`Zend_Dom`, `Zend_Feed`, `Zend_Soap`, and `Zend_XmlRpc` are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/zendframework/zendframework1

Introduced in: 1.0.0Fixed in: 1.11.13

Fixcomposer require zendframework/zendframework1:^1.11.13

References

https://framework.zend.com/security/advisory/ZF2012-02[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-02.yaml[WEB]
https://github.com/zendframework/zf1[PACKAGE]