MEDIUM
GHSA-h5p3-7mg6-hgj4
Zend Framework XEE Vulnerability
Quick fix
GHSA-h5p3-7mg6-hgj4 — zendframework/zendframework1: upgrade to the fixed version with the command below.
composer require zendframework/zendframework1:^1.11.13Details
(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/zendframework/zendframework1
Introduced in:
1.0Fixed in: 1.11.13Fix
composer require zendframework/zendframework1:^1.11.13Packagist/zendframework/zendframework1
Introduced in:
1.12.0-rc1Fixed in: 1.12.0Fix
composer require zendframework/zendframework1:^1.12.0References
- https://nvd.nist.gov/vuln/detail/CVE-2012-6531[ADVISORY]
- https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db[WEB]
- https://github.com/zendframework/zf1[PACKAGE]
- https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt[WEB]
- http://framework.zend.com/security/advisory/ZF2012-01[WEB]
- http://www.debian.org/security/2012/dsa-2505[WEB]
- http://www.openwall.com/lists/oss-security/2012/06/26/2[WEB]
- http://www.openwall.com/lists/oss-security/2012/06/26/4[WEB]
- http://www.openwall.com/lists/oss-security/2012/06/27/2[WEB]