CVE-2024-9026
PHP-FPM logs from children may be altered
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
PHP-FPM logs from children may be altered
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
Reserved 2024-09-20 | Published 2024-10-08 | Updated 2024-10-08 | Assigner phpCWE-158: Improper Neutralization of Null Byte or NUL Character
CWE-117: Improper Output Neutralization for Logs
Sébastien Rolland
github.com/...hp-src/security/advisories/GHSA-865w-9rf3-2wh5
Support options
