CVE-2021-3007
Description
Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a "vulnerability in the PHP language itself" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized
How to fix
- getlaminas laminas-http2.14.2 or later
- laminas/laminas-http2.14.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getlaminas laminas-http | v < 2.14.2 | 2.14.2 |
| zend zend_framework | 3.0.0 | — |
| zendframework/zendframeworkPackagist | v ≤ 3.0.0 | — |
| laminas/laminas-httpPackagist | v < 2.14.2 | 2.14.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.