CVE-2024-2757

PHP mb_encode_mimeheader runs endlessly for some inputs

Summary

Original description

The description as published by the source.

In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.5"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.5"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.3.5"}]}]

References

advisory github.com
advisory nvd.nist.gov
advisory security.netapp.com
advisory github.com
web openwall.com
web lists.fedoraproject.org