CVE-2022-24775 Improper Input Validation in guzzlehttp/psr7
Attackers can inject newlines into HTTP headers via improper parsing, potentially bypassing security controls or modifying data in applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24775?
CVE-2022-24775 is a high-severity vulnerability in Drupal Drupal, published on 21 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Weakness: CWE-20
Which versions are affected by CVE-2022-24775?
6 open source packages ship an affected version, including drupal, drupal/core and guzzlehttp/psr7. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
drupal Bitnami | From 8.0.0 | 9.2.16, 9.3.9 |
drupal/core Packagist | From 8.0.0 | 9.2.16, 9.3.9 |
guzzlehttp/psr7 Packagist | All versions | 1.8.4 |
guzzlehttp/psr7 Packagist | All versions | 1.8.4 |
guzzlehttp/psr7 Packagist | From 2.0.0 | 2.1.1 |
guzzlehttp/psr7 Packagist | From 2.0.0 | 2.1.1 |
Products include Drupal Drupal, Guzzlephp Psr-7.
How do I fix CVE-2022-24775?
Upgrade drupal to a fixed version for your release line: 9.2.16 or 9.3.9.
Is CVE-2022-24775 being exploited?
There is no known exploitation of CVE-2022-24775 in the wild and no public exploit code.
Other vulnerabilities in Drupal Drupal
Sources
Also known as BIT-drupal-2022-24775, DEBIAN-CVE-2022-24775, DRUPAL-CORE-2022-006, GHSA-q7rv-6hp3-vh96, UBUNTU-CVE-2022-24775.