FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv
概要
FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| phpfrankenphp |
1.5.0 以上 1.13.0 未満→ 1.13.0 |
1.13.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc_open or exec can read secrets such as database passwords set by other requests.
出典: CVE.org (CVE Program・cvelistV5) NVD