MEDIUM
GHSA-jh4x-4wmf-67pr
Zend Framework XEE Vulnerability
Quick fix
GHSA-jh4x-4wmf-67pr — zendframework/zendframework1: upgrade to the fixed version with the command below.
composer require zendframework/zendframework1:^1.11.13Details
(1) `Zend_Dom`, (2) `Zend_Feed`, (3) `Zend_Soap`, and (4) `Zend_XmlRpc` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/zendframework/zendframework1
Introduced in:
1.0Fixed in: 1.11.13Fix
composer require zendframework/zendframework1:^1.11.13Packagist/zendframework/zendframework1
Introduced in:
1.12.0-rc1Fixed in: 1.12.0Fix
composer require zendframework/zendframework1:^1.12.0References
- https://nvd.nist.gov/vuln/detail/CVE-2012-6532[ADVISORY]
- https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db[WEB]
- https://github.com/zendframework/zf1[PACKAGE]
- https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115[WEB]
- http://framework.zend.com/security/advisory/ZF2012-02[WEB]