cve-2021-3007

{
  "cvss": 0.0,
  "datePublished": "2021-01-14T00:00:00Z",
  "dateUpdated": "2021-01-14T00:00:00Z",
  "description": "Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\\Http\\Response\\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a \"vulnerability in the PHP language itself\" but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized",
  "dueDate": "",
  "id": "CVE-2021-3007",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "laminas-http",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "getlaminas laminas-http Deserialization of Untrusted Data",
  "vendor": "getlaminas"
}