Vulnerability-Lookup

OESA-2024-2248 (CVE-2024-8925)

Vulnerability from osv_openeuler – Published: 2024-10-12 11:07 – Updated: 2026-08-06 11:07 – Source website

Summary

php security update

Details

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.(CVE-2024-8925)

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.(CVE-2024-8926)

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.(CVE-2024-8927)

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.(CVE-2024-9026)

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-8925	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-8926	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-8927	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2024-9026	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "php-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-bcmath-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-cli-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-common-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-dba-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-dbg-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-debuginfo-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-debugsource-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-devel-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-embedded-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-enchant-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-ffi-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-fpm-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-gd-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-gmp-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-help-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-intl-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-ldap-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-mbstring-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-mysqlnd-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-odbc-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-opcache-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-pdo-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-pgsql-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-process-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-snmp-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-soap-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-sodium-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-tidy-8.0.30-6.oe2003sp4.aarch64.rpm",
          "php-xml-8.0.30-6.oe2003sp4.aarch64.rpm"
        ],
        "src": [
          "php-8.0.30-6.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "php-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-bcmath-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-cli-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-common-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-dba-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-dbg-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-debuginfo-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-debugsource-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-devel-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-embedded-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-enchant-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-ffi-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-fpm-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-gd-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-gmp-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-help-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-intl-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-ldap-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-mbstring-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-mysqlnd-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-odbc-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-opcache-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-pdo-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-pgsql-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-process-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-snmp-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-soap-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-sodium-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-tidy-8.0.30-6.oe2003sp4.x86_64.rpm",
          "php-xml-8.0.30-6.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "php",
        "purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.30-6.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "php-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-bcmath-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-cli-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-common-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-dba-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-dbg-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-debuginfo-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-debugsource-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-devel-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-embedded-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-enchant-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-ffi-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-fpm-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-gd-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-gmp-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-help-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-intl-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-ldap-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-mbstring-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-mysqlnd-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-odbc-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-opcache-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-pdo-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-pgsql-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-process-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-snmp-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-soap-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-sodium-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-tidy-8.0.30-6.oe2203sp1.aarch64.rpm",
          "php-xml-8.0.30-6.oe2203sp1.aarch64.rpm"
        ],
        "src": [
          "php-8.0.30-6.oe2203sp1.src.rpm"
        ],
        "x86_64": [
          "php-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-bcmath-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-cli-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-common-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-dba-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-dbg-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-debuginfo-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-debugsource-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-devel-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-embedded-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-enchant-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-ffi-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-fpm-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-gd-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-gmp-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-help-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-intl-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-ldap-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-mbstring-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-mysqlnd-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-odbc-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-opcache-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-pdo-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-pgsql-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-process-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-snmp-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-soap-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-sodium-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-tidy-8.0.30-6.oe2203sp1.x86_64.rpm",
          "php-xml-8.0.30-6.oe2203sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP1",
        "name": "php",
        "purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-22.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.30-6.oe2203sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "php-8.3.12-1.oe2403.aarch64.rpm",
          "php-bcmath-8.3.12-1.oe2403.aarch64.rpm",
          "php-cli-8.3.12-1.oe2403.aarch64.rpm",
          "php-common-8.3.12-1.oe2403.aarch64.rpm",
          "php-dba-8.3.12-1.oe2403.aarch64.rpm",
          "php-dbg-8.3.12-1.oe2403.aarch64.rpm",
          "php-debuginfo-8.3.12-1.oe2403.aarch64.rpm",
          "php-debugsource-8.3.12-1.oe2403.aarch64.rpm",
          "php-devel-8.3.12-1.oe2403.aarch64.rpm",
          "php-embedded-8.3.12-1.oe2403.aarch64.rpm",
          "php-enchant-8.3.12-1.oe2403.aarch64.rpm",
          "php-ffi-8.3.12-1.oe2403.aarch64.rpm",
          "php-fpm-8.3.12-1.oe2403.aarch64.rpm",
          "php-gd-8.3.12-1.oe2403.aarch64.rpm",
          "php-gmp-8.3.12-1.oe2403.aarch64.rpm",
          "php-help-8.3.12-1.oe2403.aarch64.rpm",
          "php-intl-8.3.12-1.oe2403.aarch64.rpm",
          "php-ldap-8.3.12-1.oe2403.aarch64.rpm",
          "php-mbstring-8.3.12-1.oe2403.aarch64.rpm",
          "php-mysqlnd-8.3.12-1.oe2403.aarch64.rpm",
          "php-odbc-8.3.12-1.oe2403.aarch64.rpm",
          "php-opcache-8.3.12-1.oe2403.aarch64.rpm",
          "php-pdo-8.3.12-1.oe2403.aarch64.rpm",
          "php-pgsql-8.3.12-1.oe2403.aarch64.rpm",
          "php-process-8.3.12-1.oe2403.aarch64.rpm",
          "php-snmp-8.3.12-1.oe2403.aarch64.rpm",
          "php-soap-8.3.12-1.oe2403.aarch64.rpm",
          "php-sodium-8.3.12-1.oe2403.aarch64.rpm",
          "php-tidy-8.3.12-1.oe2403.aarch64.rpm",
          "php-xml-8.3.12-1.oe2403.aarch64.rpm"
        ],
        "src": [
          "php-8.3.12-1.oe2403.src.rpm"
        ],
        "x86_64": [
          "php-8.3.12-1.oe2403.x86_64.rpm",
          "php-bcmath-8.3.12-1.oe2403.x86_64.rpm",
          "php-cli-8.3.12-1.oe2403.x86_64.rpm",
          "php-common-8.3.12-1.oe2403.x86_64.rpm",
          "php-dba-8.3.12-1.oe2403.x86_64.rpm",
          "php-dbg-8.3.12-1.oe2403.x86_64.rpm",
          "php-debuginfo-8.3.12-1.oe2403.x86_64.rpm",
          "php-debugsource-8.3.12-1.oe2403.x86_64.rpm",
          "php-devel-8.3.12-1.oe2403.x86_64.rpm",
          "php-embedded-8.3.12-1.oe2403.x86_64.rpm",
          "php-enchant-8.3.12-1.oe2403.x86_64.rpm",
          "php-ffi-8.3.12-1.oe2403.x86_64.rpm",
          "php-fpm-8.3.12-1.oe2403.x86_64.rpm",
          "php-gd-8.3.12-1.oe2403.x86_64.rpm",
          "php-gmp-8.3.12-1.oe2403.x86_64.rpm",
          "php-help-8.3.12-1.oe2403.x86_64.rpm",
          "php-intl-8.3.12-1.oe2403.x86_64.rpm",
          "php-ldap-8.3.12-1.oe2403.x86_64.rpm",
          "php-mbstring-8.3.12-1.oe2403.x86_64.rpm",
          "php-mysqlnd-8.3.12-1.oe2403.x86_64.rpm",
          "php-odbc-8.3.12-1.oe2403.x86_64.rpm",
          "php-opcache-8.3.12-1.oe2403.x86_64.rpm",
          "php-pdo-8.3.12-1.oe2403.x86_64.rpm",
          "php-pgsql-8.3.12-1.oe2403.x86_64.rpm",
          "php-process-8.3.12-1.oe2403.x86_64.rpm",
          "php-snmp-8.3.12-1.oe2403.x86_64.rpm",
          "php-soap-8.3.12-1.oe2403.x86_64.rpm",
          "php-sodium-8.3.12-1.oe2403.x86_64.rpm",
          "php-tidy-8.3.12-1.oe2403.x86_64.rpm",
          "php-xml-8.3.12-1.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "php",
        "purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.3.12-1.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "php-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-bcmath-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-cli-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-common-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-dba-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-dbg-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-debuginfo-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-debugsource-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-devel-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-embedded-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-enchant-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-ffi-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-fpm-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-gd-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-gmp-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-help-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-intl-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-ldap-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-mbstring-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-mysqlnd-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-odbc-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-opcache-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-pdo-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-pgsql-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-process-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-snmp-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-soap-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-sodium-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-tidy-8.0.30-6.oe2203sp4.aarch64.rpm",
          "php-xml-8.0.30-6.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "php-8.0.30-6.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "php-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-bcmath-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-cli-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-common-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-dba-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-dbg-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-debuginfo-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-debugsource-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-devel-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-embedded-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-enchant-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-ffi-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-fpm-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-gd-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-gmp-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-help-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-intl-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-ldap-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-mbstring-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-mysqlnd-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-odbc-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-opcache-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-pdo-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-pgsql-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-process-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-snmp-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-soap-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-sodium-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-tidy-8.0.30-6.oe2203sp4.x86_64.rpm",
          "php-xml-8.0.30-6.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "php",
        "purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.30-6.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "php-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-bcmath-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-cli-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-common-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-dba-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-dbg-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-debuginfo-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-debugsource-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-devel-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-embedded-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-enchant-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-ffi-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-fpm-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-gd-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-gmp-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-help-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-intl-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-ldap-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-mbstring-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-mysqlnd-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-odbc-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-opcache-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-pdo-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-pgsql-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-process-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-snmp-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-soap-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-sodium-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-tidy-8.0.30-6.oe2203sp3.aarch64.rpm",
          "php-xml-8.0.30-6.oe2203sp3.aarch64.rpm"
        ],
        "src": [
          "php-8.0.30-6.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "php-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-bcmath-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-cli-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-common-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-dba-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-dbg-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-debuginfo-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-debugsource-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-devel-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-embedded-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-enchant-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-ffi-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-fpm-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-gd-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-gmp-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-help-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-intl-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-ldap-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-mbstring-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-mysqlnd-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-odbc-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-opcache-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-pdo-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-pgsql-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-process-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-snmp-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-soap-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-sodium-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-tidy-8.0.30-6.oe2203sp3.x86_64.rpm",
          "php-xml-8.0.30-6.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "php",
        "purl": "pkg:rpm/openEuler/php\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.0.30-6.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif\r\n\r\nSecurity Fix(es):PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.\r\n\r\nSecurity Fix(es):\r\n\r\nIn PHP versions\u00a08.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.(CVE-2024-8925)\r\n\r\nIn PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12,\u00a0when using a certain non-standard configurations of Windows codepages, the fixes for\u00a0 CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 \u00a0may still be bypassed and the same command injection related to Windows \u0026quot;Best Fit\u0026quot; codepage behavior can be achieved. This\u00a0may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.(CVE-2024-8926)\r\n\r\nIn PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12,\u00a0HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to\u00a0cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.(CVE-2024-8927)\r\n\r\nIn PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is\u00a0configured to catch workers output through catch_workers_output = yes,\u00a0it may be possible to pollute the final log or\u00a0remove up to 4 characters from the log messages by manipulating log message content. Additionally, if\u00a0PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.(CVE-2024-9026)",
  "id": "OESA-2024-2248",
  "modified": "2026-08-06T11:07:43Z",
  "published": "2024-10-12T11:07:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2248"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8925"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8926"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8927"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9026"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "php security update",
  "upstream": [
    "CVE-2024-8925",
    "CVE-2024-8926",
    "CVE-2024-8927",
    "CVE-2024-9026"
  ]
}

CVE-2024-8925 (GCVE-0-2024-8925)

Vulnerability from cvelistv5 – Published: 2024-10-08 03:35 – Updated: 2025-11-03 22:33

Title

Erroneous parsing of multipart form data

Summary

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Severity

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 12:56 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

php mitre root

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://security.netapp.com/advisory/ntap-2024110…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.30 (semver) Affected: 8.2.* , < 8.2.24 (semver) Affected: 8.3.* , < 8.3.12 (semver)
php	php	Affected: 8.1.0 , < 8.1.30 (semver) Affected: 8.2.0 , < 8.2.24 (semver) Affected: 8.3.0 , < 8.3.12 (semver) cpe:2.3:a:php:php::::::::

Credits

Mihail Kirov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php",
            "versions": [
              {
                "lessThan": "8.1.30",
                "status": "affected",
                "version": "8.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.2.24",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.3.12",
                "status": "affected",
                "version": "8.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8925",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T12:56:50.614930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-444",
                "description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-17T17:56:24.654Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:33:05.003Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0003/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.30",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.24",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.12",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mihail Kirov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, e\u003c/span\u003erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.\u0026nbsp;\u003c/p\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "In PHP versions\u00a08.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-08T03:35:02.673Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Erroneous parsing of multipart form data",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2024-8925",
    "datePublished": "2024-10-08T03:35:02.673Z",
    "dateReserved": "2024-09-17T03:59:29.523Z",
    "dateUpdated": "2025-11-03T22:33:05.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8926 (GCVE-0-2024-8926)

Vulnerability from cvelistv5 – Published: 2024-10-08 03:48 – Updated: 2025-11-03 22:33

Title

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

Summary

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 12:55 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

php mitre root

References

2 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://security.netapp.com/advisory/ntap-2024110…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.30 (semver) Affected: 8.2.* , < 8.2.24 (semver) Affected: 8.3.* , < 8.3.12 (semver)
php	php	Affected: 8.1.0 , < 8.1.30 (semver) Affected: 8.2.0 , < 8.2.24 (semver) Affected: 8.3.0 , < 8.3.12 (semver) cpe:2.3:a:php:php::::::::

Date Public

2024-09-27 17:50

Credits

https://github.com/MortalAndTry

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php",
            "versions": [
              {
                "lessThan": "8.1.30",
                "status": "affected",
                "version": "8.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.2.24",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.3.12",
                "status": "affected",
                "version": "8.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T12:55:27.311454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T13:52:37.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:33:06.473Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0003/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.30",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.24",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.12",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "https://github.com/MortalAndTry"
        }
      ],
      "datePublic": "2024-09-27T17:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12,\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewhen using a certain non-standard configurations of Windows codepages, the fixes for\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/advisories/GHSA-vxpp-6299-mxw3\"\u003eCVE-2024-4577\u003c/a\u003e\u0026nbsp;may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emay allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12,\u00a0when using a certain non-standard configurations of Windows codepages, the fixes for\u00a0 CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 \u00a0may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This\u00a0may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-24T21:12:33.554Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq"
        }
      ],
      "source": {
        "advisory": "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp",
        "discovery": "EXTERNAL"
      },
      "title": "PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2024-8926",
    "datePublished": "2024-10-08T03:48:53.628Z",
    "dateReserved": "2024-09-17T04:06:56.550Z",
    "dateUpdated": "2025-11-03T22:33:06.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8927 (GCVE-0-2024-8927)

Vulnerability from cvelistv5 – Published: 2024-10-08 03:56 – Updated: 2025-11-03 22:33

Title

cgi.force_redirect configuration is bypassable due to the environment variable collision

Summary

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 12:50 UTC

CWE

CWE-1220 - Insufficient Granularity of Access Control

Assigner

php mitre root

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://security.netapp.com/advisory/ntap-2024110…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.30 (semver) Affected: 8.2.* , < 8.2.24 (semver) Affected: 8.3.* , < 8.3.12 (semver)
php	php	Affected: 8.1.0 , < 8.1.30 (semver) Affected: 8.2.0 , < 8.2.24 (semver) Affected: 8.3.0 , < 8.3.12 (semver) cpe:2.3:a:php:php::::::::

Date Public

2024-09-27 17:50

Credits

Owen Gong RyotaK

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php",
            "versions": [
              {
                "lessThan": "8.1.30",
                "status": "affected",
                "version": "8.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.2.24",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.3.12",
                "status": "affected",
                "version": "8.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8927",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T12:50:40.800289Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1220",
                "description": "CWE-1220 Insufficient Granularity of Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T16:16:00.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:33:09.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0003/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.30",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.24",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.12",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Owen Gong"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "RyotaK"
        }
      ],
      "datePublic": "2024-09-27T17:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12,\u0026nbsp;HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to\u0026nbsp;cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.\u0026nbsp;"
            }
          ],
          "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12,\u00a0HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to\u00a0cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-252",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-252 PHP Local File Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-08T03:56:31.849Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "cgi.force_redirect configuration is bypassable due to the environment variable collision",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2024-8927",
    "datePublished": "2024-10-08T03:56:31.849Z",
    "dateReserved": "2024-09-17T04:09:57.362Z",
    "dateUpdated": "2025-11-03T22:33:09.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-9026 (GCVE-0-2024-9026)

Vulnerability from cvelistv5 – Published: 2024-10-08 04:07 – Updated: 2025-11-03 22:33

Title

PHP-FPM logs from children may be altered

Summary

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-08 12:47 UTC

CWE

CWE-158 - Improper Neutralization of Null Byte or NUL Character
CWE-117 - Improper Output Neutralization for Logs

Assigner

php mitre root

References

3 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
https://security.netapp.com/advisory/ntap-2024110…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.30 (semver) Affected: 8.2.* , < 8.2.24 (semver) Affected: 8.3.* , < 8.3.12 (semver)
php	php	Affected: 8.1.0 , < 8.1.30 (semver) Affected: 8.2.0 , < 8.2.24 (semver) Affected: 8.3.0 , < 8.3.12 (semver) cpe:2.3:a:php:php::::::::

Date Public

2024-09-27 17:50

Credits

Sébastien Rolland

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php",
            "versions": [
              {
                "lessThan": "8.1.30",
                "status": "affected",
                "version": "8.1.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.2.24",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "semver"
              },
              {
                "lessThan": "8.3.12",
                "status": "affected",
                "version": "8.3.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9026",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-08T12:47:58.418408Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-08T13:52:08.340Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:33:15.254Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20241101-0003/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.30",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.24",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.12",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "S\u00e9bastien Rolland"
        }
      ],
      "datePublic": "2024-09-27T17:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is\u0026nbsp;configured to catch workers output through catch_workers_output = yes,\u0026nbsp;it may be possible to pollute the final log or\u0026nbsp;remove up to 4 characters from the log messages by manipulating log message content. Additionally, if\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ePHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is\u00a0configured to catch workers output through catch_workers_output = yes,\u00a0it may be possible to pollute the final log or\u00a0remove up to 4 characters from the log messages by manipulating log message content. Additionally, if\u00a0PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-268",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-268 Audit Log Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-158",
              "description": "CWE-158: Improper Neutralization of Null Byte or NUL Character",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-08T04:07:33.452Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "PHP-FPM logs from children may be altered",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2024-9026",
    "datePublished": "2024-10-08T04:07:33.452Z",
    "dateReserved": "2024-09-20T00:15:42.321Z",
    "dateUpdated": "2025-11-03T22:33:15.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2024-2248 (CVE-2024-8925)

CVE-2024-8925 (GCVE-0-2024-8925)

CVE-2024-8926 (GCVE-0-2024-8926)

CVE-2024-8927 (GCVE-0-2024-8927)

CVE-2024-9026 (GCVE-0-2024-9026)

Tags

Sightings

Nomenclature

Related by attack behaviour