Open mend-for-github-com[bot] opened 2 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
Vulnerable Library - aws/aws-sdk-php-3.143.2
AWS SDK for PHP - Use Amazon Web Services in your PHP project
Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/d44eac162f8ed1869d20c076adca9869c70a8ad9
Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-24775
### Vulnerable Library - guzzlehttp/psr7-1.6.1PSR-7 HTTP message library
Dependency Hierarchy: - aws/aws-sdk-php-3.143.2 (Root Library) - :x: **guzzlehttp/psr7-1.6.1** (Vulnerable Library)
Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd
Found in base branch: main
### Vulnerability Detailsguzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Publish Date: 2022-03-21
URL: CVE-2022-24775
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96
Release Date: 2022-03-21
Fix Resolution: 1.8.4,2.1.1
CVE-2022-23395
### Vulnerable Library - aws/aws-sdk-php-3.143.2AWS SDK for PHP - Use Amazon Web Services in your PHP project
Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/d44eac162f8ed1869d20c076adca9869c70a8ad9
Dependency Hierarchy: - :x: **aws/aws-sdk-php-3.143.2** (Vulnerable Library)
Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd
Found in base branch: main
### Vulnerability DetailsjQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
Publish Date: 2022-03-02
URL: CVE-2022-23395
### CVSS 3 Score Details (6.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.CVE-2023-51651
### Vulnerable Library - aws/aws-sdk-php-3.143.2AWS SDK for PHP - Use Amazon Web Services in your PHP project
Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/d44eac162f8ed1869d20c076adca9869c70a8ad9
Dependency Hierarchy: - :x: **aws/aws-sdk-php-3.143.2** (Vulnerable Library)
Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd
Found in base branch: main
### Vulnerability DetailsAWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
Publish Date: 2023-12-22
URL: CVE-2023-51651
### CVSS 3 Score Details (6.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-51651
Release Date: 2023-12-22
Fix Resolution: 3.288.1