GHSA-848f-mph5-9pm9
Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-331 Insufficient Entropy
- Fix
1.12.17- Upgrade zendframework/zendframework1 to this version or later
Description
In Zend Framework, Zend_Captcha_Word (v1) and Zend\Captcha\Word (v2) generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| zendframework/zendframework1 | >= 1.12.0, < 1.12.17 |
1.12.17 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
zendframework/zendframework1 Packagist → 1.12.17
- composer
composer require zendframework/zendframework1:^1.12.17
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
How to prevent it
- Implementation: Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6fqw-j3vm-7f66 Zendframework1 Potential SQL injection in ORDER and GROUP functions | Critical | Also affects zendframework/zendframework1 |
| GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability | High | Also affects zendframework/zendframework1 |
| GHSA-v42g-7q2x-cw32 Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | Critical | Also affects zendframework/zendframework1 |
| GHSA-2x36-qhx3-7m5f ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select | Critical | Also affects zendframework/zendframework1 |
| GHSA-9v78-h226-2rmq Zendframework potential security issue in login mechanism | High | Also affects zendframework/zendframework1 |
| GHSA-4vf6-mq7w-3hp6 Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed | Medium | Also affects zendframework/zendframework1 |
| GHSA-4v57-pwvf-x35j Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide` | Medium | Also affects zendframework/zendframework1 |
| GHSA-vvm3-rv48-j3g5 Zendframework Potential XSS or HTML Injection vector in Zend_Json | Medium | Also affects zendframework/zendframework1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor