HIGH

GHSA-5qp6-78pr-gv8c

PHP OpenID Library Denial of Service vulnerability

Quick fix

GHSA-5qp6-78pr-gv8c — openid/php-openid: upgrade to the fixed version with the command below.

composer require openid/php-openid:^2.3.0

Details

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/openid/php-openid

Introduced in: 0Fixed in: 2.3.0

Fixcomposer require openid/php-openid:^2.3.0

Packagist/typo3/cms

Introduced in: 6.2.0Fixed in: 6.2.6

Fixcomposer require typo3/cms:^6.2.6

References

https://nvd.nist.gov/vuln/detail/CVE-2013-4701[ADVISORY]
https://github.com/openid/php-openid/commit/625c16bb28bb120d262b3f19f89c2c06cb9b0da9[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/openid/php-openid/CVE-2013-4701.yaml[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2013-4701.yaml[WEB]
https://github.com/openid/php-openid[PACKAGE]
https://typo3.org/security/advisory/typo3-core-sa-2014-002[WEB]
http://jvn.jp/en/jp/JVN24713981/index.html[WEB]
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000080[WEB]
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00028.html[WEB]
http://lists.opensuse.org/opensuse-updates/2016-08/msg00083.html[WEB]