{"cvss":0.0,"datePublished":"2021-01-14T00:00:00Z","dateUpdated":"2021-01-14T00:00:00Z","description":"Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\\Http\\Response\\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a \"vulnerability in the PHP language itself\" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized","dueDate":"","id":"CVE-2021-3007","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"laminas-http","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"getlaminas laminas-http Deserialization of Untrusted Data","vendor":"getlaminas"}