Input validation error in php7 (Alpine package)



Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-11045
CWE-ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
 php7 (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Input validation error

EUVDB-ID: #VU33363

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-11045

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Mitigation

Install update from vendor's website.

Vulnerable software versions

php7 (Alpine package): 7.2.24-r0

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=5ea4a0536e0f920f0bffd2ac54ce75665830e4ab
https://git.alpinelinux.org/aports/commit/?id=c34558aad0fa77a9c307564822690940e618b972
https://git.alpinelinux.org/aports/commit/?id=2e744b63543aae404c54b88ee4b4135a58449190
https://git.alpinelinux.org/aports/commit/?id=840f665bfeaa4de03d66d8a6d69ceb3a331e3bf6
https://git.alpinelinux.org/aports/commit/?id=89bf7fcf675ffb9138a3afe613cb1f7c918b57ac


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###