GHSA-f57v-q966-7fh6 json
Monolog Header injection in NativeMailerHandler
published 2y ago modified last yr.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
A header injection vulnerability has been identified in the NativeMailerHandler of the Monolog library. This vulnerability may allow an attacker to manipulate email headers when log messages are sent via email.
Patch / fix
- packagist monolog/monolog 1.12.0
- github.com/Seldaek/monolog@515a096 commit
- github.com/Seldaek/monolog#448 pull request
Is GHSA-f57v-q966-7fh6 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | monolog/monolog | >=1.8.0, <1.12.0 |
1.12.0 |
Classification
- Weakness
-
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
-
github.com
/Seldaek/monolog/pull/448#issuecomment-68208704
web
-
github.com
/Seldaek/monolog/commit/515a096c864b00b3967f7f601680f85d4a2e4001
web
-
github.com
/Seldaek/monolog/issues/458
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/monolog/monolog/2014-12-29-1.yaml
web
-
github.com
/Seldaek/monolog
package
Sources
- GitHub Advisory GHSA-f57v-q966-7fh6
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.