CVE-2015-7503: Zend Framework Information Disclosure
Summary
CVE-2015-7503: Zend Framework Information Disclosure. Affects zendframework/zendframework across 2 version ranges.
>= 2.0.0, < 2.4.9
>= 2.5.0, < 2.5.2
Fixed in 2.4.9 or 2.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zend Framework is an open-source web application framework implemented in PHP. It provides a collection of professional PHP packages to develop web applications and services. The vulnerability affects versions before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2. The vulnerability allows remote attackers to recover the RSA private key.
Vulnerability Detail
The vulnerability in Zend Framework allows remote attackers to recover the RSA private key. This can have severe consequences as the private key is meant to be kept secret and is used for encryption and authentication purposes. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information, compromise the security of the affected system, and potentially perform further malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.4.92.4.9composer require zendframework/zendframework:2.4.9 -
>= 2.5.0, < 2.5.22.5.2composer require zendframework/zendframework:2.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of the affected packages.
Conclusion
The vulnerability in Zend Framework allows remote attackers to recover the RSA private key, posing a significant risk to the security of the affected system. It is crucial to apply the recommended fix by upgrading to the fixed versions of the affected packages. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for zendframework/zendframework →
FAQ
The vulnerability allows remote attackers to recover the RSA private key, which can lead to unauthorized access to sensitive information and compromise the security of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using the composer.lock file.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the recommended fix to mitigate the risk.
It is highly recommended to upgrade to the fixed versions of the affected packages. Manual patching may introduce errors or miss critical security fixes. It is best to follow the official recommendations and upgrade your packages.
You can find more information about this vulnerability, including the technical details and the fixed versions of the affected packages, in the advisory on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
