longman/telegram-bot-0.50.0: 2 vulnerabilities (highest severity is: 7.5)

[dev-mend-for-github-com]

Vulnerable Library - longman/telegram-bot-0.50.0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (longman/telegram-bot version)	Remediation Possible**	Reachability
CVE-2022-24775	High	7.5	guzzlehttp/psr7-1.4.2	Transitive	N/A*	❌
CVE-2023-29197	Medium	5.3	guzzlehttp/psr7-1.4.2	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24775

Vulnerable Library - guzzlehttp/psr7-1.4.2

PSR-7 message implementation that also provides common utility methods

Library home page: https://api.github.com/repos/guzzle/psr7/zipball/f5b8a8512e2b58b0071a7280e39f14f72e05d87c

Dependency Hierarchy:

• longman/telegram-bot-0.50.0 (Root Library)
  • guzzlehttp/guzzle-6.3.0
    • ❌ guzzlehttp/psr7-1.4.2 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.

Publish Date: 2022-03-21

URL: CVE-2022-24775

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q7rv-6hp3-vh96

Release Date: 2022-03-21

Fix Resolution: 1.8.4,2.1.1

CVE-2023-29197

Vulnerable Library - guzzlehttp/psr7-1.4.2

PSR-7 message implementation that also provides common utility methods

Library home page: https://api.github.com/repos/guzzle/psr7/zipball/f5b8a8512e2b58b0071a7280e39f14f72e05d87c

Dependency Hierarchy:

• longman/telegram-bot-0.50.0 (Root Library)
  • guzzlehttp/guzzle-6.3.0
    • ❌ guzzlehttp/psr7-1.4.2 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. This is a follow-up to CVE-2022-24775 where the fix was incomplete. The issue has been patched in versions 1.9.1 and 2.4.5. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Publish Date: 2023-04-17

URL: CVE-2023-29197

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.