GHSA-43xg-87xw-jpv8medium

Several Zend Products Vulnerable to XXE and XEE attacks

The advisory, in context

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

zendframework/zendframework1 Packagist

Ecosystem versions

Earlier releases before 1.12.4

Fixed in 1.12.4

4 explicitly affected versions

1.12.0, 1.12.1, 1.12.2, 1.12.3

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.12.4"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3"
  ]
}

zendframework/zendopenid Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendrest Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendservice-audioscrobbler Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendservice-nirvanix Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendservice-slideshare Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendservice-technorati Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendservice-windowsazure Packagist

Ecosystem versions

Earlier releases before 2.0.2

Fixed in 2.0.2

9 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1"
  ]
}

zendframework/zendservice-amazon Packagist

Ecosystem versions

Earlier releases before 2.0.3

Fixed in 2.0.3

10 explicitly affected versions

2.0.0, 2.0.0rc1, 2.0.0rc2, 2.0.0rc3, 2.0.0rc4, 2.0.0rc5, 2.0.0rc6, 2.0.0rc7, 2.0.1, 2.0.2

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.0.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.0.0",
    "2.0.0rc1",
    "2.0.0rc2",
    "2.0.0rc3",
    "2.0.0rc4",
    "2.0.0rc5",
    "2.0.0rc6",
    "2.0.0rc7",
    "2.0.1",
    "2.0.2"
  ]
}

zendframework/zendservice-api Packagist

Ecosystem versions

Earlier releases before 1.0.0

Fixed in 1.0.0

1 explicitly affected versions

1.0.0beta1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.0.0beta1"
  ]
}

Set up in your agent.

Investigate in your agent.

Several Zend Products Vulnerable to XXE and XEE attacks

The advisory, in context

Affected packages

References