Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yang3LXhnODMtajJtN84AA80A

Zendframework Denial of Service vector via XEE injection

Zend_Dom, Zend_Feed, Zend_Soap, and Zend_XmlRpc are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.

Permalink: https://github.com/advisories/GHSA-2jx7-xg83-j2m7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yang3LXhnODMtajJtN84AA80A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 months ago
Updated: 4 months ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-2jx7-xg83-j2m7
References:

• https://framework.zend.com/security/advisory/ZF2012-02
• https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2012-02.yaml
• https://github.com/advisories/GHSA-2jx7-xg83-j2m7

Blast Radius: 21.9

Affected Packages