Detections
Analytics
Fedora 39 : php (2024-52c23ef1ec)
critical Nessus Plugin ID 200458
Language:
Synopsis
The remote Fedora host is missing one or more security updates.Description
The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-52c23ef1ec advisory.**PHP version 8.2.20** (06 Jun 2024)
**CGI:**
* Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier)
* Fixed bug [GHSA-3qgc-jrrr-25jv](https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv) (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos)
**CLI:**
* Fixed bug [GH-14189](https://github.com/php/php-src/issues/14189) (PHP Interactive shell input state incorrectly handles quoted heredoc literals.). (nielsdos)
**Core:**
* Fixed bug [GH-13970](https://github.com/php/php-src/issues/13970) (Incorrect validation of #[Attribute] flags type for non-compile-time expressions). (ilutov)
* Fixed bug [GH-14140](https://github.com/php/php-src/issues/14140) (Floating point bug in range operation on Apple Silicon hardware). (Derick, Saki)
**DOM:**
* Fix crashes when entity declaration is removed while still having entity references. (nielsdos)
* Fix references not handled correctly in C14N. (nielsdos)
* Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos)
* Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos)
**FFI:**
* Fixed bug [GH-14215](https://github.com/php/php-src/issues/14215) (Cannot use FFI::load on CRLF header file with apache2handler). (nielsdos)
**Filter:**
* Fixed bug [GHSA-w8qr-v226-r27w](https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w) (Filter bypass in filter_var FILTER_VALIDATE_URL). (**CVE-2024-5458**) (nielsdos)
**FPM:**
* Fix bug [GH-14175](https://github.com/php/php-src/issues/14175) (Show decimal number instead of scientific notation in systemd status). (Benjamin Cremer)
**Hash:**
* ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi)
**Intl:**
* Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot)
**Ini:**
* Fixed bug [GH-14100](https://github.com/php/php-src/issues/14100) (Corrected spelling mistake in php.ini files). (Marcus Xavier)
**MySQLnd:**
* Fix bug [GH-14255](https://github.com/php/php-src/issues/14255) (mysqli_fetch_assoc reports error from nested query). (Kamil Tekiela)
**Opcache:**
* Fixed bug [GH-14109](https://github.com/php/php-src/issues/14109) (Fix accidental persisting of internal class constant in shm). (ilutov)
**OpenSSL:**
* The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (**CVE-2024-2408**)
**Standard:**
* Fixed bug [GHSA-9fcc-425m-g385](https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385) (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)
**XML:**
* Fixed bug [GH-14124](https://github.com/php/php-src/issues/14124) (Segmentation fault with XML extension under certain memory limit). (nielsdos)
**XMLReader:**
* Fixed bug [GH-14183](https://github.com/php/php-src/issues/14183) (XMLReader::open() can't be overridden). (nielsdos)
Tenable has extracted the preceding description block directly from the Fedora security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected php package.See Also
https://bodhi.fedoraproject.org/updates/FEDORA-2024-52c23ef1ec
Plugin Details
Severity: Critical
ID: 200458
File Name: fedora_2024-52c23ef1ec.nasl
Version: 1.5
Type: local
Agent: unix
Family: Fedora Local Security Checks
Published: 6/13/2024
Updated: 10/4/2024
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2012-1823
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
CVSS Score Source: CVE-2024-4577
Vulnerability Information
CPE: cpe:/o:fedoraproject:fedora:39, p-cpe:/a:fedoraproject:fedora:php
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/4/2024
Vulnerability Publication Date: 5/4/2012
CISA Known Exploited Vulnerability Due Dates: 4/15/2022, 7/3/2024
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (PHP CGI Argument Injection)
Reference Information
CVE: CVE-2012-1823, CVE-2024-1874, CVE-2024-2408, CVE-2024-4577, CVE-2024-5458, CVE-2024-5585