What is GHSA-jh4x-4wmf-67pr?

GHSA-jh4x-4wmf-67pr is a security advisory published by GitHub Security Advisories with Medium severity. Zend Framework XEE Vulnerability

Which CVE IDs does GHSA-jh4x-4wmf-67pr cover?

GHSA-jh4x-4wmf-67pr covers the following CVE IDs: CVE-2012-6532. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jh4x-4wmf-67pr?

GHSA-jh4x-4wmf-67pr affects 2 products, including: composer/zendframework/zendframework1:\u003e= 1.0, \u003c 1.11.13; composer/zendframework/zendframework1:\u003e= 1.12.0-rc1, \u003c 1.12.0.

GHSA-jh4x-4wmf-67prMedium

Zend Framework XEE Vulnerability

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 12, 2024

🔗 CVE IDs covered (1)

CVE-2012-6532 →

📋 Description

(1) Zend_Dom, (2) Zend_Feed, (3) Zend_Soap, and (4) Zend_XmlRpc in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.

🎯 Affected products2

composer/zendframework/zendframework1:>= 1.0, < 1.11.13
composer/zendframework/zendframework1:>= 1.12.0-rc1, < 1.12.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2012-6532
http://framework.zend.com/security/advisory/ZF2012-02
https://github.com/zendframework/zf1/commit/1b5e86183a72b7b10b6c89e4f95f08c5da9716db
https://web.archive.org/web/20131101014013/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:115/?name=MDVSA-2013:115
https://github.com/advisories/GHSA-jh4x-4wmf-67pr