-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework | composer | >= 2.0.0beta4, < 2.3.8 | 2.3.8 |
| zendframework/zendframework | composer | >= 2.4.0rc1, < 2.4.1 | 2.4.1 |
| zendframework/zend-http | composer | >= 2.0.0beta4, < 2.3.8 | 2.3.8 |
| zendframework/zend-http | composer | >= 2.4.0rc1, < 2.4.1 | 2.4.1 |
| zendframework/zendframework1 | composer | < 1.12.12 | 1.12.12 |
| zendframework/zend-http | composer | < 1.12.12 | 1.12.12 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of CRLF sequences in header values. The advisory explicitly references Zend\Mail and Zend\Http components, with examples showing header injection via setSubject(). The patch introduced HeaderValue validation classes, indicating pre-patch header setters like setSubject() and addHeaderLine() were vulnerable. The ZF1 equivalent Zend_Mail methods would share the same flaw. These functions directly accepted user-controlled header values without sanitization, allowing attackers to inject malicious headers via CRLF sequences.