GHSA-2jx7-xg83-j2m7 Zendframework Denial of Service vector via XEE injection
Attackers can cause Denial of Service in Zend Framework components via XML Entity Expansion attacks, affecting applications processing untrusted XML.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2jx7-xg83-j2m7?
GHSA-2jx7-xg83-j2m7 is a denial of service vulnerability in zendframework/zendframework1, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.Which versions are affected by GHSA-2jx7-xg83-j2m7?
2 open source packages ship an affected version, including zendframework/zendframework1.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zendframework1 Packagist | From 1.0.0 | 1.11.13 |
zendframework/zendframework1 Packagist | From 1.0.0 | 1.11.13 |
How do I fix GHSA-2jx7-xg83-j2m7?
Upgrade zendframework/zendframework1 to 1.11.13 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-2jx7-xg83-j2m7 being exploited?
There is no known exploitation of GHSA-2jx7-xg83-j2m7 in the wild and no public exploit code.