Configuring a proxy in a stream context might allow for CRLF injection in URIs
Résumé
Configuring a proxy in a stream context might allow for CRLF injection in URIs
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-11234 php7.4 Corrigé dans: 7.4.33-1+deb11u7
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web lists.debian.org