guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or …
中危 CVSS 4.2
摘要
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://github.com/guzzle/psr7/commit/ddd64f17d4cc1f7e5ffe6fd2c989ec7221712580 Patch
- https://github.com/guzzle/psr7/pull/811 Issue Tracking
- https://github.com/guzzle/psr7/releases/tag/2.12.3 Product
- https://github.com/guzzle/psr7/security/advisories/GHSA-c2w2-prh8-qm98 Mitigation
时间线
- nvd_ingest NVD