Configuring a proxy in a stream context might allow for CRLF injection in URIs
Summary
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Original description
The description as published by the source.
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-11234 php7.4 Fixed in: 7.4.33-1+deb11u7
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web lists.debian.org