GHSA-5wm2-38q5-5rxv CVE-2014-2683
Several Zend Products Vulnerable to XXE and XEE attacks
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 2.35%
- Chance of exploitation in the next 30 days. Higher than 83.72% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
- CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
- Fix
- Available
- 10 packages have a fixed version
Description
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| zendframework/zendframework1 | < 1.12.4 |
1.12.4 |
| zendframework/zendopenid | < 2.0.2 |
2.0.2 |
| zendframework/zendrest | < 2.0.2 |
2.0.2 |
| zendframework/zendservice-amazon | < 2.0.3 |
2.0.3 |
| zendframework/zendservice-api | < 1.0.0 |
1.0.0 |
| zendframework/zendservice-audioscrobbler | < 2.0.2 |
2.0.2 |
| zendframework/zendservice-nirvanix | < 2.0.2 |
2.0.2 |
| zendframework/zendservice-slideshare | < 2.0.2 |
2.0.2 |
| zendframework/zendservice-technorati | < 2.0.2 |
2.0.2 |
| zendframework/zendservice-windowsazure | < 2.0.2 |
2.0.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
zendframework/zendframework1 Packagist → 1.12.4
- composer
composer require zendframework/zendframework1:^1.12.4
zendframework/zendopenid Packagist → 2.0.2
- composer
composer require zendframework/zendopenid:^2.0.2
zendframework/zendrest Packagist → 2.0.2
- composer
composer require zendframework/zendrest:^2.0.2
zendframework/zendservice-amazon Packagist → 2.0.3
- composer
composer require zendframework/zendservice-amazon:^2.0.3
zendframework/zendservice-api Packagist → 1.0.0
- composer
composer require zendframework/zendservice-api:^1.0.0
zendframework/zendservice-audioscrobbler Packagist → 2.0.2
- composer
composer require zendframework/zendservice-audioscrobbler:^2.0.2
zendframework/zendservice-nirvanix Packagist → 2.0.2
- composer
composer require zendframework/zendservice-nirvanix:^2.0.2
zendframework/zendservice-slideshare Packagist → 2.0.2
- composer
composer require zendframework/zendservice-slideshare:^2.0.2
zendframework/zendservice-technorati Packagist → 2.0.2
- composer
composer require zendframework/zendservice-technorati:^2.0.2
zendframework/zendservice-windowsazure Packagist → 2.0.2
- composer
composer require zendframework/zendservice-windowsazure:^2.0.2
Weakness
CWE-611: Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
How to prevent it
- Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
How to prevent it
- Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
- Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
References
Advisories
Other links
- web.archive.org/web/20140419041226/http://www.securityfocus.com/bid/66358
- web.archive.org/web/20150523055201/http://www.mandriva.com/en/support/security/advis…
- advisories.mageia.org/MGASA-2014-0151.html
- framework.zend.com/security/advisory/ZF2014-01
- seclists.org/oss-sec/2014/q2/0
- debian.org/security/2015/dsa-3265
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6fqw-j3vm-7f66 Zendframework1 Potential SQL injection in ORDER and GROUP functions | Critical | Also affects zendframework/zendframework1 |
| GHSA-848f-mph5-9pm9 Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | Critical | Also affects zendframework/zendframework1 |
| GHSA-2x36-qhx3-7m5f ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | Critical | Also affects zendframework/zendframework1 |
| GHSA-9v78-h226-2rmq Zendframework potential security issue in login mechanism | High | Also affects zendframework/zendframework1 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | Medium | Also affects zendframework/zendframework1 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | Medium | Also affects zendframework/zendframework1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor