Bug 1226072 (CVE-2024-4577) - VUL-0: CVE-2024-4577: php5,php53,php7,php72,php74,php8: argument Injection in PHP-CGI, bypass of CVE-2012-1823
Summary: VUL-0: CVE-2024-4577: php5,php53,php7,php72,php74,php8: argument Injection in...
Status: RESOLVED FIXED
Alias: CVE-2024-4577
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Petr Gajdos
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/409036/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-07 07:45 UTC by SMASH SMASH
Modified: 2024-06-07 08:35 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-07 07:45:24 UTC 
From: Alan Coopersmith <alan.coopersmith () oracle com>
Date: Thu, 6 Jun 2024 17:04:53 -0700






In https://fosstodon.org/@php/112570710411472992 it is written:



The Changelog link includes further details:

 - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
   in PHP-CGI). (CVE-2024-4577)

 - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var
   FILTER_VALIDATE_URL). (CVE-2024-5458)

 - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)

 - The openssl_private_decrypt function in PHP, when using PKCS1 padding
   (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the
   Marvin Attack unless it is used with an OpenSSL version that includes
   the changes from this pull request:
       https://github.com/openssl/openssl/pull/13817
   (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2
   and have also been backported to stable versions of various Linux
   distributions, as well as to the PHP builds provided for Windows since
   the previous release. All distributors and builders should ensure that
   this version is used to prevent PHP from being vulnerable.

Unfortunately the related advisories don't seem to be published yet under those
GHSA id's on https://github.com/php/php-src/security .

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4577
https://seclists.org/oss-sec/2024/q2/273
Comment 2 Andrea Mattiazzo 2024-06-07 08:07:41 UTC 
The vulnerability only affect Windows due to the Best-Fit feature of encoding conversion, so we are not affected.

https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
Comment 3 OBSbugzilla Bot 2024-06-07 08:35:04 UTC 
This is an autogenerated message for OBS integration:
This bug (1226072) was mentioned in
https://build.opensuse.org/request/show/1179149 Factory / php8