Packagist/zendframework/zendframework: critical 9.8
Zendframework vulnerable to XXE/XEE attacks
Action: Upgrade zendframework/zendframework to 2.1.6 or later.
composer require zendframework/zendframework:2.1.6composer require zendframework/zendframework:2.2.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.1.0 | 2.1.6 | - |
| 2.2.0 | 2.2.6 | - |
Fixed versions
| 2.1.6 | 2.2.6 |
Sources
- osv: GHSA-qc7w-4567-84wv
- https://github.com/zendframework/zendframework/commit/225a8c9f1c3bc08c0bddf22486a8a39ff7186ac1
- https://github.com/zendframework/zendframework/commit/5dab7b8e77741dbba56209616b7815bb04f4c561
- https://github.com/zendframework/zendframework/commit/68d0756c596baeefad0b733b42ef2657d09c7f4e
- https://github.com/zendframework/zendframework/commit/bbcf41e676ef6d8f16ea9d6499050bca0787eb6c
- https://github.com/zendframework/zendframework/commit/ee7f81cc996fb1c16c7dae23eca9ec013ab74730
- https://github.com/zendframework/zendframework/commit/fbeba98d5a9924b026a5dd98f679143fd6be89ea
- https://framework.zend.com/security/advisory/ZF2014-01
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/ZF2014-01.yaml
- https://github.com/zendframework/zendframework
published · modified · JSON