CVE-2018-17082 The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brig...
MediumCVSS 6.1
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | < 5.6.38 | 5.6.38 |
| PHP | >= 7.0.0, < 7.0.32 | 7.0.32 |
| PHP | >= 7.1.0, < 7.1.22 | 7.1.22 |
| PHP | >= 7.2.0, < 7.2.10 | 7.2.10 |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| netapp storage automation store | All versions | No fix listed |
| alpine/php5(Alpine:v3.5) | < 5.6.38-r0 | 5.6.38-r0 |
| alpine/php5(Alpine:v3.8) | < 5.6.38-r0 | 5.6.38-r0 |
| alpine/php7(Alpine:v3.5) | < 7.0.32-r0 | 7.0.32-r0 |
| alpine/php7(Alpine:v3.7) | < 7.1.29-r0 | 7.1.29-r0 |
References
- php.net release-notes
- php.net release-notes
- RHSA-2019:2519 vendor-advisory
- bugs.php.net exploit issue-tracking vendor-advisory
- github.com patch vendor-advisory
- [debian-lts-announce] 20180920 [SECURITY] [DLA 1509-1] php5 security update mailing-list third-party-advisory
- GLSA-201812-01 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- DSA-4353 third-party-advisory vendor-advisory
- www.tenable.com
- security.alpinelinux.org vendor-advisory