Configuring a proxy in a stream context might allow for CRLF injection in URIs
概要
Configuring a proxy in a stream context might allow for CRLF injection in URIs
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-11234 php7.4 修正版: 7.4.33-1+deb11u7
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web lists.debian.org