CVE-2024-5585
Published: 9 June 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Notes
| Author | Note |
|---|---|
| mdeslaur |
This appears to be a Windows specific issue, marking as not-affected |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
| jammy |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| trusty |
Not vulnerable
(windows-specific)
|
|
| upstream |
Needs triage
|
|
|
php7.0
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
| jammy |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(windows-specific)
|
|
|
php7.2
Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(windows-specific)
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
php7.4
Launchpad, Ubuntu, Debian |
focal |
Not vulnerable
(windows-specific)
|
| jammy |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| upstream |
Not vulnerable
(debian: Windows-specific)
|
|
|
php8.1
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
| jammy |
Not vulnerable
(windows-specific)
|
|
| mantic |
Does not exist
|
|
| noble |
Does not exist
|
|
| upstream |
Not vulnerable
(windows-specific)
|
|
|
php8.2
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
| jammy |
Does not exist
|
|
| mantic |
Not vulnerable
(windows-specific)
|
|
| noble |
Does not exist
|
|
| upstream |
Not vulnerable
(debian: Windows-specific)
|
|
|
php8.3
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
| jammy |
Does not exist
|
|
| mantic |
Does not exist
|
|
| noble |
Not vulnerable
(windows-specific)
|
|
| upstream |
Not vulnerable
(windows-specific)
|
|
|
Patches:
upstream: https://github.com/php/php-src/commit/4b15f5d4ec750b31ec8911f5eb0915a45f96feca upstream: https://github.com/php/php-src/commit/e6a82adace67fd018546bd2767262cfefc7daab0 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |