cgi.force_redirect configuration is bypassable due to the en…(CVE-2024-8927)

概要

cgi.force_redirect configuration is bypassable due to the environment variable collision

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.30"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.12"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.30"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.12"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.30"},{"introduced":"8.2.0"},{"fixed":"8.2.24"},{"introduced":"8.3.0"},{"fixed":"8.3.12"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2024-8927 php7.4 修正版: 7.4.33-1+deb11u6

参照URL

advisory github.com
advisory nvd.nist.gov
advisory security.netapp.com
advisory github.com
web lists.debian.org