GHSA-v59p-p692-v382critical9.8
Zend Framework Allows SQL Injection
Impact
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
zendframework/zendframework Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.2.10Ecosystem versions | 2.2.10 |
| From 2.3.0 before 2.3.5Ecosystem versions | 2.3.5 |
View original version evidence (43 explicit versions)
zendframework/zend-db Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.2.10Ecosystem versions | 2.2.10 |
| From 2.3.0 before 2.3.5Ecosystem versions | 2.3.5 |
View original version evidence (31 explicit versions)
Original source description
Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2015-0270
- Patch github.com/zendframework/zendframework/commit/569f18228f5fc84534af6ff2f367ca1a7143ec65
- Security advisory framework.zend.com/security/advisory/ZF2015-02
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2015-0270.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-0270.yaml
- Source reference github.com/zendframework/zendframework