Monday, March 28, 2022

Drupal: CVE-2022-24775: Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-006

rapid7 vulnerabilities In: rapid7, vulnerabilities

Description
guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values. The issue is patched in 1.8.4 and 2.1.1. There are currently no known workarounds.
Solution(s)
drupal-upgrade-9_2_1
drupal-upgrade-9_3_9


Referenceshttps://attackerkb.com/topics/cve-2022-24775
CVE - 2022-24775
https://www.drupal.org/sa-core-2022-006