aws/aws-sdk-php-3.143.2: 3 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - aws/aws-sdk-php-3.143.2

AWS SDK for PHP - Use Amazon Web Services in your PHP project

Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/d44eac162f8ed1869d20c076adca9869c70a8ad9

Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (aws/aws-sdk-php version)	Remediation Possible**
CVE-2022-24775	High	7.5	guzzlehttp/psr7-1.6.1	Transitive	N/A*	❌
CVE-2022-23395	Medium	6.1	aws/aws-sdk-php-3.143.2	Direct	N/A	❌
CVE-2023-51651	Medium	6.0	aws/aws-sdk-php-3.143.2	Direct	3.288.1	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24775

Vulnerable Library - guzzlehttp/psr7-1.6.1

PSR-7 HTTP message library

Dependency Hierarchy:

• aws/aws-sdk-php-3.143.2 (Root Library)
  • ❌ guzzlehttp/psr7-1.6.1 (Vulnerable Library)

Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd

Found in base branch: main

Vulnerability Details

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

Publish Date: 2022-03-21

URL: CVE-2022-24775

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q7rv-6hp3-vh96

Release Date: 2022-03-21

Fix Resolution: 1.8.4,2.1.1

CVE-2022-23395

Vulnerable Library - aws/aws-sdk-php-3.143.2

AWS SDK for PHP - Use Amazon Web Services in your PHP project

Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/d44eac162f8ed1869d20c076adca9869c70a8ad9

Dependency Hierarchy:

• ❌ aws/aws-sdk-php-3.143.2 (Vulnerable Library)

Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd

Found in base branch: main

Vulnerability Details

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

Publish Date: 2022-03-02

URL: CVE-2022-23395

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2023-51651

Vulnerable Library - aws/aws-sdk-php-3.143.2

AWS SDK for PHP - Use Amazon Web Services in your PHP project

Library home page: https://api.github.com/repos/aws/aws-sdk-php/zipball/d44eac162f8ed1869d20c076adca9869c70a8ad9

Dependency Hierarchy:

• ❌ aws/aws-sdk-php-3.143.2 (Vulnerable Library)

Found in HEAD commit: 4cd03afa364ce79169ece6fb7d8cc36d521117bd

Found in base branch: main

Vulnerability Details

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The buildEndpoint method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.

Publish Date: 2023-12-22

URL: CVE-2023-51651

CVSS 3 Score Details (6.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-51651

Release Date: 2023-12-22

Fix Resolution: 3.288.1

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.