In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

oracle CPUOct2024: MySQL Server 9.0.2

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3920 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3920-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 14, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : php7.4     Version        : 7.4.33-1+deb11u6     CVE ID         : CVE-2022-4900 CVE-2024-5458 CVE-2024-8925 CVE-2024-8927                      CVE-2024-9026     Debian Bug     : 1072885

    Multiple security issues were found in PHP, a widely-used open source     general purpose scripting language, which could result in execution of     arbitrary code, erroneous parsing of invalid URLs or multipart form     data, configuration setting bypass, or log pollution.

    CVE-2022-4900

        It was discovered that setting the environment variable         PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer         overflow.

    CVE-2024-5458

        Due to a code logic error, filtering functions such as filter_var         when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs         the function results in invalid user information (username +         password part of URLs) being treated as valid user information.
        This may lead to the downstream code accepting invalid URLs as valid         and parsing them incorrectly.

        This causes the same problems as CVE-2020-7071, but with IPv6 host         parts.

    CVE-2024-8925

        Mihail Kirov discovered an erroneous parsing of multipart form data         contained in an HTTP POST request, which could lead to legitimate         data not being processed thereby violating data integrity.

    CVE-2024-8927

        It was discovered that the `cgi.force_redirect` configuration         setting is bypassable due to environment variable collision.

    CVE-2024-9026

        In PHP-FPM, when configured to catch workers output through         catch_workers_output = yes configuration, it may be possible to         pollute the final log with up to 4 characters from the         FPM_STDIO_CMD_FLUSH macro, or remove up to 4 characters from the         logs.

    For Debian 11 bullseye, these problems have been fixed in version     7.4.33-1+deb11u6.

    We recommend that you upgrade your php7.4 packages.

    For the detailed security status of php7.4 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php7.4

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.23-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2024-005 advisory.

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6841-2 advisory.

    USN-6841-1 fixed a vulnerability in PHP. This update provides the corresponding updates for Ubuntu 16.04     LTS and Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is . It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-12 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. One of the third-     party components (PHP) was found to contain vulnerabilities, and updated versions have been made available     by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade these     components to address the potential impact of the issues. Security Center Patch SC-202407.1 updates PHP to     version 8.2.20 to address the identified vulnerabilities. Tenable has released Security Center Patch     SC-202407.1 to address these issues. The installation files can be obtained from the Tenable Downloads     Portal: https://www.tenable.com/downloads/security-center (CVE-2024-5458, CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-32 (PHP: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-678 advisory.

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the     default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the     changes from this pull request:  https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable.

    PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix     the vulnerability. (CVE-2024-2408)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-654 advisory.

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the     default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the     changes from this pull request:  https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable.

    PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix     the vulnerability. (CVE-2024-2408)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5458 advisory.

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This May lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.1.29-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2024-005 advisory.

    The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the     default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the     changes from this pull request:  https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable.

    PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix     the vulnerability. (CVE-2024-2408)

    The vulnerability allows a remote attacker to bypass implemented security restrictions.

    The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a     standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by     PHP applications.

    Note, the vulnerability exists due to incomplete fix for #VU67756 (CVE-2022-31629). (CVE-2024-2756)

    The vulnerability allows a remote attacker to bypass authentication process.

    The vulnerability exists due to an error in within the password_verify() function, which can erroneously     return true. A remote attacker can bypass implemented authentication based on the vulnerable function and     gain unauthorized access to the web application. (CVE-2024-3096)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5717 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5717-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 20, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : php8.2     CVE ID         : CVE-2024-5458

    It was discovered that user validation was incorrectly implemented     for filter_var(FILTER_VALIDATE_URL).

    For the stable distribution (bookworm), this problem has been fixed in     version 8.2.20-1~deb12u1.

    We recommend that you upgrade your php8.2 packages.

    For the detailed security status of php8.2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php8.2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6841-1 advisory.

    It was discovered that PHP could early return in the filter_var function resulting in invalid user     information being treated as valid user information. An attacker could possibly use this issue to expose     raw user input information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3833 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3833-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     June 17, 2024                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : php7.3     Version        : 7.3.31-1~deb10u7     CVE ID         : CVE-2024-5458     Debian Bug     : 1072885

    PHP, a widely-used open source general purpose scripting language, is affected     by a security problem when parsing certain types of URLs.

    Due to a code logic error filtering functions such as filter_var when     validating URLs (FILTER_VALIDATE_URL) will result in invalid user information     (username + password part of URLs) being treated as valid user information.
    This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. The problem is related to CVE-2020-7071 but affects     IPv6 host parts.

    For Debian 10 buster, this problem has been fixed in version     7.3.31-1~deb10u7.

    We recommend that you upgrade your php7.3 packages.

    For the detailed security status of php7.3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/php7.3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2037-1 advisory.

    - CVE-2024-2756: Fixed bypass of security fix applied for CVE-2022-31629 that lead PHP to consider not     secure cookies as secure (bsc#1222857)
    - CVE-2024-3096: Fixed bypass on null byte leading passwords checked via password_verify (bsc#1222858)
    - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL.
    (bsc#1226073)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2038-1 advisory.

    - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL.
    (bsc#1226073)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2039-1 advisory.

    - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL.
    (bsc#1226073)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2027-1 advisory.

    - CVE-2024-5458: Fixed an issue that allows to bypass filters in filter_var FILTER_VALIDATE_URL.
    (bsc#1226073)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-52c23ef1ec advisory.

    **PHP version 8.2.20** (06 Jun 2024)

    **CGI:**

    * Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier)
    * Fixed bug [GHSA-3qgc-jrrr-25jv](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)     (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos)

    **CLI:**

    * Fixed bug [GH-14189](https://github.com/php/php-src/issues/14189) (PHP Interactive shell input state     incorrectly handles quoted heredoc literals.). (nielsdos)

    **Core:**

    * Fixed bug [GH-13970](https://github.com/php/php-src/issues/13970) (Incorrect validation of #[Attribute]     flags type for non-compile-time expressions). (ilutov)
    * Fixed bug [GH-14140](https://github.com/php/php-src/issues/14140) (Floating point bug in range operation     on Apple Silicon hardware). (Derick, Saki)

    **DOM:**

    * Fix crashes when entity declaration is removed while still having entity references. (nielsdos)
    * Fix references not handled correctly in C14N. (nielsdos)
    * Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos)
    * Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos)

    **FFI:**

    * Fixed bug [GH-14215](https://github.com/php/php-src/issues/14215) (Cannot use FFI::load on CRLF header     file with apache2handler). (nielsdos)

    **Filter:**

    * Fixed bug [GHSA-w8qr-v226-r27w](https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w)     (Filter bypass in filter_var FILTER_VALIDATE_URL). (**CVE-2024-5458**) (nielsdos)

    **FPM:**

    * Fix bug [GH-14175](https://github.com/php/php-src/issues/14175) (Show decimal number instead of     scientific notation in systemd status). (Benjamin Cremer)

    **Hash:**

    * ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)

    **Intl:**

    * Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot)

    **Ini:**

    * Fixed bug [GH-14100](https://github.com/php/php-src/issues/14100) (Corrected spelling mistake in php.ini     files). (Marcus Xavier)

    **MySQLnd:**

    * Fix bug [GH-14255](https://github.com/php/php-src/issues/14255) (mysqli_fetch_assoc reports error from     nested query). (Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-14109](https://github.com/php/php-src/issues/14109) (Fix accidental persisting of internal     class constant in shm). (ilutov)

    **OpenSSL:**

    * The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is     the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes     the changes from this pull request: https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable. (**CVE-2024-2408**)

    **Standard:**

    * Fixed bug [GHSA-9fcc-425m-g385](https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385)     (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

    **XML:**

    * Fixed bug [GH-14124](https://github.com/php/php-src/issues/14124) (Segmentation fault with XML extension     under certain memory limit). (nielsdos)

    **XMLReader:**

    * Fixed bug [GH-14183](https://github.com/php/php-src/issues/14183) (XMLReader::open() can't be     overridden). (nielsdos)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-49aba7b305 advisory.

    **PHP version 8.3.8** (06 Jun 2024)

    **CGI:**

    * Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier)
    * Fixed bug [GHSA-3qgc-jrrr-25jv](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv)     (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos)

    **CLI:**

    * Fixed bug [GH-14189](https://github.com/php/php-src/issues/14189) (PHP Interactive shell input state     incorrectly handles quoted heredoc literals.). (nielsdos)

    **Core:**

    * Fixed bug [GH-13970](https://github.com/php/php-src/issues/13970) (Incorrect validation of #[Attribute]     flags type for non-compile-time expressions). (ilutov)

    **DOM:**

    * Fix crashes when entity declaration is removed while still having entity references. (nielsdos)
    * Fix references not handled correctly in C14N. (nielsdos)
    * Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos)
    * Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos)

    **Filter:**

    * Fixed bug [GHSA-w8qr-v226-r27w](https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w)     (Filter bypass in filter_var FILTER_VALIDATE_URL). (**CVE-2024-5458**) (nielsdos)

    **FPM:**

    * Fix bug [GH-14175](https://github.com/php/php-src/issues/14175) (Show decimal number instead of     scientific notation in systemd status). (Benjamin Cremer)

    **Hash:**

    * ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)

    **Intl:**

    * Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot)

    **MySQLnd:**

    * Fix bug [GH-14255](https://github.com/php/php-src/issues/14255) (mysqli_fetch_assoc reports error from     nested query). (Kamil Tekiela)

    **Opcache:**

    * Fixed bug [GH-14109](https://github.com/php/php-src/issues/14109) (Fix accidental persisting of internal     class constant in shm). (ilutov)

    **OpenSSL:**

    * The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is     the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes     the changes from this pull request: https://github.com/openssl/openssl/pull/13817     (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to     stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since     the previous release. All distributors and builders should ensure that this version is used to prevent PHP     from being vulnerable. (**CVE-2024-2408**)

    **Standard:**

    * Fixed bug [GHSA-9fcc-425m-g385](https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385)     (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

    **XML:**

    * Fixed bug [GH-14124](https://github.com/php/php-src/issues/14124) (Segmentation fault with XML extension     under certain memory limit). (nielsdos)

    **XMLReader:**

    * Fixed bug [GH-14183](https://github.com/php/php-src/issues/14183) (XMLReader::open() can't be     overridden). (nielsdos)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.29, 8.2.x prior to 8.2.20, or 8.3.x prior to 8.3.8. It is, therefore, affected by multiple vulnerabilities:

 - An argument Injection in PHP-CGI with a bypass of CVE-2012-1823. (CVE-2024-4577)

 - A filter bypass in filter_var FILTER_VALIDATE_URL. (CVE-2024-5458)

 - A bypass of CVE-2024-1874. (CVE-2024-5585)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php81 installed on the remote host is prior to 8.1.29 / 8.3.8. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-158-01 advisory.

    New php packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the php81 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.1.29. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.29 advisory.

  - sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-     cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote     attackers to execute arbitrary code by placing command-line options in the query string, related to lack     of skipping a certain php_getopt for the 'd' case. (CVE-2012-1823)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874     does not work if the command name includes trailing spaces. Original issue: when using proc_open() command     with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled     by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
    (CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.2.20. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.20 advisory.

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874     does not work if the command name includes trailing spaces. Original issue: when using proc_open() command     with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled     by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
    (CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.8. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.8 advisory.

  - sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-     cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote     attackers to execute arbitrary code by placing command-line options in the query string, related to lack     of skipping a certain php_getopt for the 'd' case. (CVE-2012-1823)

  - In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open()     command with array syntax, due to insufficient escaping, if the arguments of the executed command are     controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in     Windows shell. (CVE-2024-1874)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-     CGI on Windows, if the system is set up to use certain code pages, Windows may use Best-Fit behavior to     replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those     characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and     thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error,     filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of     URLs the function will result in invalid user information (username + password part of URLs) being treated     as valid user information. This may lead to the downstream code accepting invalid URLs as valid and     parsing them incorrectly. (CVE-2024-5458)

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874     does not work if the command name includes trailing spaces. Original issue: when using proc_open() command     with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled     by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
    (CVE-2024-5585)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208984	Debian dla-3920 : libapache2-mod-php7.4 - security update	Nessus	Debian Local Security Checks	high
208047	Amazon Linux 2 : php (ALASPHP8.2-2024-005)	Nessus	Amazon Linux Local Security Checks	medium
206790	Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerability (USN-6841-2)	Nessus	Ubuntu Local Security Checks	medium
206716	Tenable Security Center Multiple Vulnerabilities (TNS-2024-12)	Nessus	Misc.	high
205520	GLSA-202408-32 : PHP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
205109	Amazon Linux 2023 : php8.2, php8.2-bcmath, php8.2-cli (ALAS2023-2024-678)	Nessus	Amazon Linux Local Security Checks	medium
202925	Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2024-654)	Nessus	Amazon Linux Local Security Checks	medium
201752	CBL Mariner 2.0 Security Update: php (CVE-2024-5458)	Nessus	MarinerOS Local Security Checks	medium
200910	Amazon Linux 2 : php (ALASPHP8.1-2024-005)	Nessus	Amazon Linux Local Security Checks	medium
200782	Debian dsa-5717 : libapache2-mod-php8.2 - security update	Nessus	Debian Local Security Checks	medium
200740	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : PHP vulnerability (USN-6841-1)	Nessus	Ubuntu Local Security Checks	medium
200704	Debian dla-3833 : libapache2-mod-php7.3 - security update	Nessus	Debian Local Security Checks	medium
200688	SUSE SLES15 Security Update : php7 (SUSE-SU-2024:2037-1)	Nessus	SuSE Local Security Checks	medium
200673	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:2038-1)	Nessus	SuSE Local Security Checks	medium
200671	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2024:2039-1)	Nessus	SuSE Local Security Checks	medium
200511	SUSE SLES12 Security Update : php8 (SUSE-SU-2024:2027-1)	Nessus	SuSE Local Security Checks	medium
200458	Fedora 39 : php (2024-52c23ef1ec)	Nessus	Fedora Local Security Checks	critical
200375	Fedora 40 : php (2024-49aba7b305)	Nessus	Fedora Local Security Checks	critical
114298	PHP 8.1.x < 8.1.29 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114297	PHP 8.2.x < 8.2.20 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114296	PHP 8.3.x < 8.3.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
200177	Slackware Linux 15.0 / current php81 Multiple Vulnerabilities (SSA:2024-158-01)	Nessus	Slackware Local Security Checks	critical
200170	PHP 8.1.x < 8.1.29 Multiple Vulnerabilities	Nessus	CGI abuses	critical
200162	PHP 8.2.x < 8.2.20 Multiple Vulnerabilities	Nessus	CGI abuses	critical
200161	PHP 8.3.x < 8.3.8 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2024-5458

medium

Tenable Plugins

Coming Soon

high

medium

medium

high

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical