CVE-2014-2683
Description
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
How to fix
- zend zend_framework1.12.4, 2.1.6, 2.2.6 or later
- zendframework/zendframework11.12.4 or later
- zendframework/zendopenid2.0.2 or later
- zendframework/zendrest2.0.2 or later
- zendframework/zendservice-audioscrobbler2.0.2 or later
- zendframework/zendservice-nirvanix2.0.2 or later
- zendframework/zendservice-slideshare2.0.2 or later
- zendframework/zendservice-technorati2.0.2 or later
- zendframework/zendservice-windowsazure2.0.2 or later
- zendframework/zendservice-amazon2.0.3 or later
- zendframework/zendservice-api1.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zend zendrest | v ≤ 2.0.1 | — |
| zend zend_framework | v < 1.12.4, 2.1.0 ≤ v < 2.1.6, 2.2.0 ≤ v < 2.2.6 | 1.12.4, 2.1.6, 2.2.6 |
| zend zendservice_slideshare | v ≤ 2.0.1 | — |
| zend zendservice_api | v ≤ 1.0.0 | — |
| zend zendservice_audioscrobbler | v ≤ 2.0.1 | — |
| zend zendservice_amazon | v ≤ 2.0.2 | — |
| zend zendservice_technorati | v ≤ 2.0.1 | — |
| zend zendservice_windowsazure | v ≤ 2.0.1 | — |
| zend zendopenid | v ≤ 2.0.1 | — |
| zend zendservice_nirvanix | v ≤ 2.0.1 | — |
| zendframework/zendframework1Packagist | v < 1.12.4 | 1.12.4 |
| zendframework/zendopenidPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendrestPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-audioscrobblerPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-nirvanixPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-slidesharePackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-technoratiPackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-windowsazurePackagist | v < 2.0.2 | 2.0.2 |
| zendframework/zendservice-amazonPackagist | v < 2.0.3 | 2.0.3 |
| zendframework/zendservice-apiPackagist | v < 1.0.0 | 1.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.