search

Vonage-Community / sample-core-laravel_php-sandbox

Some sandbox code for use with various PHP-SDK products
0 stars 0 forks source link

laravel/framework-v9.0.2: 2 vulnerabilities (highest severity is: 0.0) #1

Open mend-for-github-com[bot] opened 2 years ago

mend-for-github-com[bot] commented 2 years ago
Vulnerable Library - laravel/framework-v9.0.2

The Laravel Framework.

Library home page: https://api.github.com/repos/laravel/framework/zipball/4c7cd8c4e95d161c0c6ada6efa0a5af4d0d487c9

Found in HEAD commit: 28a6c7cfa5160073d4146b827a79a6fcd2be3429

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (laravel/framework-v9.0.2 version) Remediation Possible**
CVE-2024-52301 Low 0.0 laravel/framework-v9.0.2 Direct laravel/framework-6.20.45,7.30.7,8.83.28,9.52.17,10.48.23,11.31.0 ❌
CVE-2024-51736 Low 0.0 symfony/process-v6.0.3 Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-52301 ### Vulnerable Library - laravel/framework-v9.0.2

The Laravel Framework.

Library home page: https://api.github.com/repos/laravel/framework/zipball/4c7cd8c4e95d161c0c6ada6efa0a5af4d0d487c9

Dependency Hierarchy: - :x: **laravel/framework-v9.0.2** (Vulnerable Library)

Found in HEAD commit: 28a6c7cfa5160073d4146b827a79a6fcd2be3429

Found in base branch: main

### Vulnerability Details

Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerability fixed in 6.20.45, 7.30.7, 8.83.28, 9.52.17, 10.48.23, and 11.31.0. The framework now ignores argv values for environment detection on non-cli SAPIs.

Publish Date: 2024-11-12

URL: CVE-2024-52301

### CVSS 3 Score Details (0.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/laravel/framework/security/advisories/GHSA-gv7v-rgg6-548h

Release Date: 2024-11-12

Fix Resolution: laravel/framework-6.20.45,7.30.7,8.83.28,9.52.17,10.48.23,11.31.0

CVE-2024-51736 ### Vulnerable Library - symfony/process-v6.0.3

Executes commands in sub-processes

Library home page: https://api.github.com/repos/symfony/process/zipball/298ed357274c1868c20a0061df256a1250a6c4af

Dependency Hierarchy: - laravel/framework-v9.0.2 (Root Library) - :x: **symfony/process-v6.0.3** (Vulnerable Library)

Found in HEAD commit: 28a6c7cfa5160073d4146b827a79a6fcd2be3429

Found in base branch: main

### Vulnerability Details

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named "cmd.exe" is located in the current working directory it will be called by the "Process" class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-11-06

URL: CVE-2024-51736

### CVSS 3 Score Details (0.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2024-11-06

Fix Resolution: symfony/process - v5.4.46,v6.4.14,v7.1.7

mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 5 months ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

mend-for-github-com[bot] commented 3 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 3 weeks ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.