bref/bref-0.5.25: 11 vulnerabilities (highest severity is: 8.0) #8
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.
Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - guzzlehttp/guzzle-6.5.4
Guzzle is a PHP HTTP client library
Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cookie header, allowing a malicious server to set cookies for unrelated domains. The cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with ['cookies' => true] are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. Guzzle versions 6.5.6 and 7.4.3 contain a patch for this issue. As a workaround, turn off the cookie middleware.
Publish Date: 2022-05-25
URL: CVE-2022-29248
CVSS 3 Score Details (8.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29248
Release Date: 2022-05-25
Fix Resolution: guzzlehttp/guzzle - 6.5.6,guzzlehttp/guzzle - 7.4.3
Vulnerable Library - symfony/http-client-v5.1.0
Symfony HttpClient component
Library home page: https://api.github.com/repos/symfony/http-client/zipball/63342eabdc6fc6c12e6b18506a207d16687aa33f
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
Publish Date: 2020-09-02
URL: CVE-2020-15094
CVSS 3 Score Details (8.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-754h-5r27-7x3r
Release Date: 2020-09-02
Fix Resolution: 4.4.13,5.1.5
Vulnerable Library - guzzlehttp/guzzle-6.5.4
Guzzle is a PHP HTTP client library
Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Guzzle, an extensible PHP HTTP client.
AuthorizationandCookieheaders on requests are sensitive information. In affected versions on making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove theAuthorizationandCookieheaders from the request, before containing. Previously, we would only consider a change in host or scheme. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.Publish Date: 2022-06-27
URL: CVE-2022-31091
CVSS 3 Score Details (7.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31091
Release Date: 2022-06-27
Fix Resolution: 6.5.8,7.4.5
Vulnerable Library - guzzlehttp/guzzle-6.5.4
Guzzle is a PHP HTTP client library
Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Guzzle, an extensible PHP HTTP client.
Authorizationheaders on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use theCURLOPT_HTTPAUTHoption to specify anAuthorizationheader. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove theCURLOPT_HTTPAUTHoption before continuing, stopping curl from appending theAuthorizationheader to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle steam handler backend, rather than curl.Publish Date: 2022-06-27
URL: CVE-2022-31090
CVSS 3 Score Details (7.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-25mq-v84q-4j7r
Release Date: 2022-05-19
Fix Resolution: 6.5.8,7.4.5
Vulnerable Library - guzzlehttp/guzzle-6.5.4
Guzzle is a PHP HTTP client library
Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Guzzle is an open source PHP HTTP client. In affected versions
Authorizationheaders on requests are sensitive information. On making a request using thehttpsscheme to a server which responds with a redirect to a URI with thehttpscheme, we should not forward theAuthorizationheader on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix,httpstohttpdowngrades did not result in theAuthorizationheader being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.Publish Date: 2022-06-09
URL: CVE-2022-31043
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-w248-ffj2-4v5q
Release Date: 2022-06-10
Fix Resolution: 6.5.7,7.4.4
Vulnerable Library - guzzlehttp/guzzle-6.5.4
Guzzle is a PHP HTTP client library
Library home page: https://api.github.com/repos/guzzle/guzzle/zipball/a4a1b6930528a8f7ee03518e6442ec7a44155d9d
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Guzzle is an open source PHP HTTP client. In affected versions the
Cookieheaders on requests are sensitive information. On making a request using thehttpsscheme to a server which responds with a redirect to a URI with thehttpscheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward theCookieheader on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and anyCookieheader manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.Publish Date: 2022-06-09
URL: CVE-2022-31042
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-f2wf-25xc-69c9
Release Date: 2022-06-10
Fix Resolution: 6.5.7,7.4.4
Vulnerable Library - bref/bref-0.5.25
Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.
Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a
RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each which contains a file, it is extracted and saved in/tmpwith a random filename starting withbref_upload_. The flow mimics what plain PHP does but it does not delete the temporary files when the request has been processed. An attacker could fill the Lambda instance disk by performing multiple MultiPart requests containing files. This vulnerability is patched in 2.1.13.Publish Date: 2024-02-01
URL: CVE-2024-24752
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-x4hh-frx8-98r5
Release Date: 2024-02-01
Fix Resolution: 2.1.13
Vulnerable Library - bref/bref-0.5.25
Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.
Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the latest one is kept. If an application relies on multiple headers with the same key being set for security reasons, then Bref would lower the application security. For example, if an application sets multiple
Content-Security-Policyheaders, then Bref would just reflect the latest one. This vulnerability is patched in 2.1.13.Publish Date: 2024-02-01
URL: CVE-2024-24753
CVSS 3 Score Details (4.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-99f9-gv72-fw9r
Release Date: 2024-02-01
Fix Resolution: 2.1.13
Vulnerable Library - bref/bref-0.5.25
Bref is a framework to write and deploy serverless PHP applications on AWS Lambda.
Library home page: https://api.github.com/repos/brefphp/bref/zipball/a153faeacd1ee4e31fb5465e80286ab32eef813e
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a
RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content added in the$filesor$parsedBodyarrays. The conversion process produces a different output compared to the one of plain PHP when keys ending with and open square bracket ([) are used. Based on the application logic the difference in the body parsing might lead to vulnerabilities and/or undefined behaviors. This vulnerability is patched in 2.1.13.Publish Date: 2024-02-01
URL: CVE-2024-24754
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-82vx-mm6r-gg8w
Release Date: 2024-02-01
Fix Resolution: 2.1.13
Vulnerable Library - symfony/http-client-v5.1.0
Symfony HttpClient component
Library home page: https://api.github.com/repos/symfony/http-client/zipball/63342eabdc6fc6c12e6b18506a207d16687aa33f
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the "NoPrivateNetworkHttpClient", some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the "NoPrivateNetworkHttpClient" now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-11-06
URL: CVE-2024-50342
CVSS 3 Score Details (3.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-9c3x-r3wp-mgxm
Release Date: 2024-11-06
Fix Resolution: symfony/http-client- v5.4.46,v6.4.14,v7.1.7
Vulnerable Library - symfony/process-v5.1.0
Symfony Process Component
Library home page: https://api.github.com/repos/symfony/process/zipball/7f6378c1fa2147eeb1b4c385856ce9de0d46ebd1
Dependency Hierarchy:
Found in HEAD commit: a98b02cc6219479db20e92032a8c3cb68016cfdb
Found in base branch: main
Vulnerability Details
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named "cmd.exe" is located in the current working directory it will be called by the "Process" class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-11-06
URL: CVE-2024-51736
CVSS 3 Score Details (0.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-11-06
Fix Resolution: symfony/process - v5.4.46,v6.4.14,v7.1.7
The text was updated successfully, but these errors were encountered: