Digest · Friday

Security digest: June 7, 2024

9 critical advisories.

Take stock

Composer (PHP): 9 critical advisories (willdurand/js-translation-bundle, zendframework/zendframework1, zendframework/zendframework, zendframework/zend-xmlrpc, zendframework/zend-json). Check with composer audit.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 9

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 9

Check: composer audit

willdurand/js-translation-bundle potential path traversal attack and remote code injection GHSA-x86x-qhf8-f37w CVSS 9.8 Critical
willdurand/js-translation-bundle < 2.1.1 → fixed in 2.1.1
Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) GHSA-v42g-7q2x-cw32 CVSS 9.8 Critical
zendframework/zendframework1 >= 1.12.0, < 1.12.16 → fixed in 1.12.16
ZendFramework potential SQL Injection Vector When Using PDO_MySql GHSA-qf36-fx9f-232x CVSS 9.8 Critical
zendframework/zendframework1 >= 1.10.0, < 1.10.9 → fixed in 1.10.9; zendframework/zendframework1 >= 1.11.0, < 1.11.6 → fixed in 1.11.6
Zendframework vulnerable to XXE/XEE attacks GHSA-qc7w-4567-84wv CVSS 9.8 Critical
zendframework/zendframework >= 2.1.0, < 2.1.6 → fixed in 2.1.6; zendframework/zendframework >= 2.2.0, < 2.2.6 → fixed in 2.2.6
ZendFramework potential XML eXternal Entity injection vectors GHSA-mhpx-3rv8-wrjm CVSS 9.8 Critical
zendframework/zendframework1 >= 1.12.0, < 1.12.4 → fixed in 1.12.4
ZendFramework vulnerable to XXE/XEE attacks GHSA-f4fj-q6m4-cc52 CVSS 9.8 Critical
zendframework/zend-xmlrpc >= 2.1.0, < 2.1.6 → fixed in 2.1.6; zendframework/zend-xmlrpc >= 2.2.0, < 2.2.6 → fixed in 2.2.6
Zend-JSON vulnerable to XXE/XEE attacks GHSA-8x2v-pcg7-94f4 CVSS 9.8 Critical
zendframework/zend-json >= 2.1.0, < 2.1.6 → fixed in 2.1.6; zendframework/zend-json >= 2.2.0, < 2.2.6 → fixed in 2.2.6
Zendframework1 Potential SQL injection in ORDER and GROUP functions GHSA-6fqw-j3vm-7f66 CVSS 9.8 Critical
zendframework/zendframework1 < 1.12.20 → fixed in 1.12.20
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select GHSA-2x36-qhx3-7m5f CVSS 9.8 Critical
zendframework/zendframework1 >= 1.12.0, < 1.12.7 → fixed in 1.12.7