GHSA-f57v-q966-7fh6: 
PHP vulnerability analysis and mitigation

A header injection vulnerability was discovered in the NativeMailerHandler component of Monolog library, affecting versions 1.8.0 through 1.12.0. The vulnerability was identified on December 29, 2014, and could potentially allow attackers to manipulate email headers when log messages are sent via email (GitHub Advisory).

The vulnerability exists in the NativeMailerHandler component where attacker-controlled data could be used to set the encoding or content type of emails. An example of exploitation would involve manipulating the encoding parameter like $nmh->setEncoding("utf-8\r\nFrom: faked@attacker.org"), which could lead to header injection (Monolog PR). The vulnerability is rated as Low severity according to the GitHub Advisory Database (GitHub Advisory).

If successfully exploited, this vulnerability could allow attackers to manipulate email headers in log messages sent via email, potentially leading to email header injection attacks (GitHub Advisory).

While the vulnerability exists, it was noted as being unlikely to be exploited in practice since it would require user input to be directly used in setting the encoding or content type parameters (Monolog Comment).

The vulnerability was patched in version 1.12.0 of Monolog. The fix involves implementing validation in the setters to prevent newline characters in content type and encoding parameters (Monolog Commit).