In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

The remote host is affected by the vulnerability described in GLSA-202408-32 (PHP: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5e8ae0def0 advisory.

  - Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and     same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a
    __Host- or __Secure- cookie by PHP applications. (CVE-2024-2756)

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

  - In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with     password_hash() starts with a null byte (\x00), testing a blank string as the password via     password_verify() will incorrectly return true. (CVE-2024-3096)

  - In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain     long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a     hostile user sends data to an application that uses this function. (CVE-2024-2757)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.28, 8.2.x prior to 8.2.18, or 8.3.x prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities:

 - A command injection via array-ish $command parameter of proc_open. (CVE-2024-1874)

 - __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)

 - password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

 - mb_encode_mimeheader runs endlessly for some inputs. (CVE-2024-2757)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6d82c5e9-fc24-11ee-a689-04421a1baf97 advisory.

  - This update includes 3 security fixes: (CVE-2024-1874, CVE-2024-2756, CVE-2024-2757, CVE-2024-3096)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.6. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.6 advisory.

  - In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site     attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or     `__Secure-` cookie by PHP applications. (CVE-2022-31629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205520	GLSA-202408-32 : PHP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
194645	Fedora 40 : php (2024-5e8ae0def0)	Nessus	Fedora Local Security Checks	medium
114272	PHP 8.1.x < 8.1.28 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114271	PHP 8.2.x < 8.2.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114270	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
193406	FreeBSD : php -- Multiple vulnerabilities (6d82c5e9-fc24-11ee-a689-04421a1baf97)	Nessus	FreeBSD Local Security Checks	critical
193201	PHP 8.3.x < 8.3.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2024-2757

high

Tenable Plugins

critical

medium

critical

critical

critical

critical

medium