CVE-2024-8925

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. %if 1 The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server when running in prefork mode. This module is deprecated. %endif

Security Fix(es):PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.(CVE-2024-8925)

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.(CVE-2024-8926)

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.(CVE-2024-8927)

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.(CVE-2024-9026)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

• php: Erroneous parsing of multipart form data (CVE-2024-8925)

• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)

• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

• php: Erroneous parsing of multipart form data (CVE-2024-8925)

• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)

• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: 1-byte array overrun in common path resolve code (CVE-2023-0568)
• php: Password_verify() always return true with some hash (CVE-2023-0567)
• php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247)
• php: XML loading external entity without being enabled (CVE-2023-3823)
• php: phar Buffer mismanagement (CVE-2023-3824)
• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

• CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
• CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer

• CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer

• CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer

• CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer

• SECURITY UPDATE: prevent erroneous parsing
  • debian/patches/CVE-2024-8925.patch: limit multipart/form-data boundaries size to prevent erroneous parsing
  • CVE-2024-8925

• SECURITY UPDATE: prevent erroneous parsing
  • debian/patches/CVE-2024-8925.patch: limit boundary size to prevent erroneous parsing in multipart/form-data POST data
  • CVE-2024-8925

• CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer

• CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer

• CVE-2024-8925: fix erroneous parsing of multipart form data contained in an HTTP POST request
• CVE-2024-9026: fix log tampering in PHP-FPM
• CVE-2024-5458: fix early-out for ipv6 hostname validation, ensure full check is performed

These are all security issues fixed in the php8-8.3.12-1.1 package on the GA media of openSUSE Tumbleweed.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

• php: Erroneous parsing of multipart form data (CVE-2024-8925)

• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)

• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: 1-byte array overrun in common path resolve code (CVE-2023-0568)

• php: Password_verify() always return true with some hash (CVE-2023-0567)

• php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247)

• php: XML loading external entity without being enabled (CVE-2023-3823)

• php: phar Buffer mismanagement (CVE-2023-3824)

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)

• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)

• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

• php: Erroneous parsing of multipart form data (CVE-2024-8925)

• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)

• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for php8 fixes the following issues:

• CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360)
• CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358)
• CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

This update for php8 fixes the following issues:

Update to php 8.2.24:

• CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360)
• CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358)
• CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

This update for php74 fixes the following issues:

• CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360)
• CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358)
• CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

This update for php7 fixes the following issues:

• CVE-2024-8925: Fixed erroneous parsing of multipart form data in HTTP POST requests leads to legitimate data not being processed (bsc#1231360)
• CVE-2024-8927: Fixed cgi.force_redirect configuration is bypassable due to an environment variable collision (bsc#1231358)
• CVE-2024-9026: Fixed pollution of worker output logs in PHP-FPM (bsc#1231382)

It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. (CVE-2024-8925)

It was discovered that PHP incorrectly handled the cgi.force_redirect configuration option due to environment variable collisions. In certain configurations, an attacker could possibly use this issue bypass force_redirect restrictions. (CVE-2024-8927)

It was discovered that PHP-FPM incorrectly handled logging. A remote attacker could possibly use this issue to alter and inject arbitrary contents into log files. This issue only affected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-9026)

USN-7049-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. (CVE-2024-8925)

It was discovered that PHP incorrectly handled the cgi.force_redirect configuration option due to environment variable collisions. In certain configurations, an attacker could possibly use this issue bypass force_redirect restrictions. (CVE-2024-8927)

USN-7049-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 14.04 LTS.

Original advisory details:

It was discovered that PHP incorrectly handled parsing multipart form data.A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. (CVE-2024-8925)

It was discovered that PHP incorrectly handled the cgi.force_redirect configuration option due to environment variable collisions. In certain configurations, an attacker could possibly use this issue bypass force_redirect restrictions. (CVE-2024-8927)