DEBIAN-CVE-2023-29197

    Dashboard / Vulnerabilities / DEBIAN-CVE-2023-29197

    DEBIAN-CVE-2023-29197

    Published: 17 Apr 2023Last Modified: 15 Sept 2026
    Upstream:
    CVE-2023-29197

    Summary:

    Details: guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

    References: https://security-tracker.debian.org/tracker/CVE-2023-29197

    Affected packages

    Package

    Name: php-guzzlehttp-psr7

    Purl: pkg:deb/debian/php-guzzlehttp-psr7?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.4.5-1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2023-29197 | CVE-DB