CVE-2014-2682
Description
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
How to fix
- zend zend_framework1.12.4, 2.1.6, 2.2.6 or later
- zendframework/zendframework11.12.4 or later
- zendframework/zendopenid2.0.2 or later
- zendframework/zendrest2.0.2 or later
- zendframework/zendservice-audioscrobbler2.0.2 or later
- zendframework/zendservice-nirvanix2.0.2 or later
- zendframework/zendservice-slideshare2.0.2 or later
- zendframework/zendservice-technorati2.0.2 or later
- zendframework/zendservice-windowsazure2.0.2 or later
- zendframework/zendservice-amazon2.0.3 or later
- zendframework/zendservice-api1.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zend zendrest | v ≤ 2.0.1 | — |
| zend zend_framework | v < 1.12.4, 2.1.0 ≤ v < 2.1.6, 2.2.0 ≤ v < 2.2.6 | 1.12.4, 2.1.6, 2.2.6 |
| zend zendservice_slideshare | v ≤ 2.0.1 | — |
| zend zendservice_api | v ≤ 1.0.0 | — |
| zend zendservice_audioscrobbler | v ≤ 2.0.1 | — |
| zend zendservice_amazon | v ≤ 2.0.2 | — |
| zend zendservice_technorati | v ≤ 2.0.1 | — |
| zend zendservice_windowsazure | v ≤ 2.0.1 | — |
| zend zendopenid | v ≤ 2.0.1 | — |
| zend zendservice_nirvanix | v ≤ 2.0.1 | — |
| zendframework/zendframework1Packagist | v < 1.12.4 | 1.12.4 |
| zendframework/zendopenidPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendrestPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-audioscrobblerPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-nirvanixPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-slidesharePackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-technoratiPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-windowsazurePackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-amazonPackagist | v < 2.0.3 | 2.0.3 |
| zendframework/zendservice-apiPackagist | v < 1.0.0 | 1.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.