Bug 1215712 (CVE-2015-3154)

Summary:	CVE-2015-3154 php-ZendFramework2: ZF2015-04: Potential header and mail injection vulnerability
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, felix, jrusnack, security-response-team, shawn, vkaigoro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Zend Framework 2.3.8, Zend Framework 2.4.1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-21 09:36:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1223761, 1223762, 1223763, 1223871, 1223872
Bug Blocks:	1223088

Description Vasyl Kaigorodov 2015-04-27 14:13:30 UTC

Zend Framework upstream reported the below issue:
"""
Title: ZF2015-04: Potential header and mail injection vulnerability
Type: Bypass

We have confirmed a vulnerability reported against the Zend\Mail component in
Zend Framework 2, specifically in how it handles headers. Headers are not
correctly filtered for newlines, allowing the ability to:

- send additional, unrelated headers
- bypass additional headers by emitting the header/body separator sequence

We are in the process of reviewing a patch, and plan to release the following
new ZF2 versions with the patch in the next 1-2 weeks:

- Zend Framework 2.3.8
- Zend Framework 2.4.1
"""

Comment 1 Kurt Seifried 2015-05-19 19:20:49 UTC

This is now public:

http://framework.zend.com/security/advisory/ZF2015-04

Comment 2 Stefan Cornelius 2015-05-21 12:16:10 UTC

Created php-ZendFramework tracking bugs for this issue:

Affects: fedora-all [bug 1223762]
Affects: epel-all [bug 1223763]

Comment 3 Stefan Cornelius 2015-05-21 15:09:54 UTC

Created php-ZendFramework2 tracking bugs for this issue:

Affects: fedora-all [bug 1223871]
Affects: epel-all [bug 1223872]

Comment 4 Fedora Update System 2015-05-30 15:41:09 UTC

php-ZendFramework-1.12.13-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2015-06-01 16:59:46 UTC

php-ZendFramework-1.12.13-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-06-01 17:00:29 UTC

php-ZendFramework-1.12.13-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-06-10 19:15:27 UTC

php-ZendFramework-1.12.13-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2015-06-10 19:17:24 UTC

php-ZendFramework2-2.3.9-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2015-06-10 19:18:40 UTC

php-ZendFramework-1.12.13-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Shawn Iwinski 2015-07-20 02:01:21 UTC

All dependent bugs are closed, can this tracking bug be closed as well?

Comment 11 Vasyl Kaigorodov 2015-07-21 09:36:54 UTC

Absolutely, Shawn.
Closing this.