NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

ZendFramework Information Disclosure and Insufficient Entropy vulnerabilityGHSA-2fhr-8r8r-qp56

MEDIUMFix: zendframework/zendframework@ced8ff9

GHSA-2fhr-8r8r-qp56 is a medium-severity (CVSS 5.3) vulnerability in zendframework/zendframework. A fix is available for zendframework/zendframework — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 4, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐘zendframework/zendframework

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

In Zend Framework, Zend_Captcha_Word (v1) and Zend\Captcha\Word (v2) generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistzendframework/zendframework≥ 2.0.0&&< 2.4.92.4.9composer require zendframework/zendframework:^2.4.9

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for zendframework/zendframework, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update zendframework/zendframework to 2.4.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2fhr-8r8r-qp56 is resolved across your whole dependency graph.

  3. Workarounds

    Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

In Zend Framework, `Zend_Captcha_Word` (v1) and `Zend\Captcha\Word` (v2) generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's `internal array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.
O3 Security · Impact-Aware SCA

Is GHSA-2fhr-8r8r-qp56 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
ZendFramework Information Disclosure and Insufficient…