ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities in zendframework/zendframework
Summary
GHSA-xg9w-r469-m455: ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities. Affects zendframework/zendframework across 2 version ranges.
>= 2.0.0, < 2.0.8
>= 2.1.0, < 2.1.4
Fixed in 2.0.8 or 2.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ZendFramework is a popular open-source PHP framework that provides a collection of professional PHP packages. It offers a wide range of functionalities for developing web applications, including components for generating random numbers and validating CSRF tokens. However, versions 2.0.0 to 2.0.8 and 2.1.0 to 2.1.4 of zendframework/zendframework are vulnerable to potential information disclosure and insufficient entropy issues.
Vulnerability Detail
The vulnerability in ZendFramework arises from the use of PHP's mt_rand() function as a fallback for generating random bytes when the OpenSSL or Mcrypt extensions are not available. The outputs of mt_rand() are predictable for the same PHP process, making it susceptible to a Seed Recovery Attack. An attacker with access to a random number from mt_rand() or a session ID generated without additional entropy can easily brute force the seed used by the Marsenne-Twister algorithm in mt_rand(). This attack can lead to the disclosure of sensitive information and the ability to predict the output of other mt_rand() calls within the same PHP process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.82.0.8composer require zendframework/zendframework:2.0.8 -
>= 2.1.0, < 2.1.42.1.4composer require zendframework/zendframework:2.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround is to use a different random number generation method that provides sufficient entropy. One option is to use the random_bytes() function introduced in PHP 7, which utilizes the operating system's random number generator. Here is an example of how to generate random bytes using random_bytes():
$randomBytes = random_bytes($length);
Conclusion
In conclusion, versions 2.0.0 to 2.0.8 and 2.1.0 to 2.1.4 of zendframework/zendframework are vulnerable to potential information disclosure and insufficient entropy issues. It is crucial to upgrade to fixed versions or apply the recommended workaround to mitigate the risk of unauthorized access and other malicious activities.
See every vulnerability recorded for zendframework/zendframework →
FAQ
The vulnerability can lead to the disclosure of sensitive information and the ability to predict the output of other mt_rand() calls within the same PHP process. This can potentially be exploited to gain unauthorized access or perform other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, only versions 2.0.0 to 2.0.8 and 2.1.0 to 2.1.4 of zendframework/zendframework are affected. It is recommended to upgrade to versions 2.0.9 or higher for the 2.0.x branch, and versions 2.1.5 or higher for the 2.1.x branch.
Yes, if upgrading to the fixed versions is not immediately possible, you can use a different random number generation method that provides sufficient entropy. One option is to use the random_bytes() function introduced in PHP 7.
Yes, the CVSS score for this vulnerability is 7.4, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for zendframework/zendframework.
