Erroneous parsing of multipart form data (CVE-2024-8925)

Summary

Erroneous parsing of multipart form data

Original description

The description as published by the source.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.30"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.12"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.30"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.12"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.30"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.12"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-8925 php7.4 Fixed in: 7.4.33-1+deb11u6

References

advisory github.com
advisory nvd.nist.gov
advisory security.netapp.com
advisory github.com
web lists.debian.org