fix CVE-2024-8925, CVE-2024-8926, CVE-2024-8927, CVE-2024-9026
(cherry picked from commit 16d8b59d234157315d22a9eeebd504829439ed63)
This commit is contained in:
Funda Wang
openeuler-sync-bot
parent
4fb2c9d095
commit
6a7583c050
188
php-cve-2024-8925.patch
Normal file
188
php-cve-2024-8925.patch
Normal file
@ -0,0 +1,188 @@
|
|||||||
|
From 2b0daf421c162376892832588eccdfa9a286ed09 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
|
||||||
|
Date: Mon, 9 Sep 2024 15:22:07 +0200
|
||||||
|
Subject: [PATCH 3/8] Fix GHSA-9pqp-7h25-4f32
|
||||||
|
|
||||||
|
multipart/form-data boundaries larger than the read buffer result in erroneous
|
||||||
|
parsing, which violates data integrity.
|
||||||
|
|
||||||
|
Limit boundary size, as allowed by RFC 1521:
|
||||||
|
|
||||||
|
Encapsulation boundaries [...] must be no longer than 70 characters, not
|
||||||
|
counting the two leading hyphens.
|
||||||
|
|
||||||
|
We correctly parse payloads with boundaries of length up to
|
||||||
|
FILLUNIT-strlen("\r\n--") bytes, so allow this for BC.
|
||||||
|
|
||||||
|
(cherry picked from commit 19b49258d0c5a61398d395d8afde1123e8d161e0)
|
||||||
|
---
|
||||||
|
main/rfc1867.c | 7 ++
|
||||||
|
tests/basic/GHSA-9pqp-7h25-4f32.inc | 3 +
|
||||||
|
tests/basic/GHSA-9pqp-7h25-4f32.phpt | 100 +++++++++++++++++++++++++++
|
||||||
|
3 files changed, 110 insertions(+)
|
||||||
|
create mode 100644 tests/basic/GHSA-9pqp-7h25-4f32.inc
|
||||||
|
create mode 100644 tests/basic/GHSA-9pqp-7h25-4f32.phpt
|
||||||
|
|
||||||
|
diff --git a/main/rfc1867.c b/main/rfc1867.c
|
||||||
|
index 3086e8da3db..eafe6a67d2e 100644
|
||||||
|
--- a/main/rfc1867.c
|
||||||
|
+++ b/main/rfc1867.c
|
||||||
|
@@ -752,6 +752,13 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
|
||||||
|
boundary_len = boundary_end-boundary;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* Boundaries larger than FILLUNIT-strlen("\r\n--") characters lead to
|
||||||
|
+ * erroneous parsing */
|
||||||
|
+ if (boundary_len > FILLUNIT-strlen("\r\n--")) {
|
||||||
|
+ sapi_module.sapi_error(E_WARNING, "Boundary too large in multipart/form-data POST data");
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* Initialize the buffer */
|
||||||
|
if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) {
|
||||||
|
sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
|
||||||
|
diff --git a/tests/basic/GHSA-9pqp-7h25-4f32.inc b/tests/basic/GHSA-9pqp-7h25-4f32.inc
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..adf72a361a2
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/basic/GHSA-9pqp-7h25-4f32.inc
|
||||||
|
@@ -0,0 +1,3 @@
|
||||||
|
+<?php
|
||||||
|
+print "Hello world\n";
|
||||||
|
+var_dump($_POST);
|
||||||
|
diff --git a/tests/basic/GHSA-9pqp-7h25-4f32.phpt b/tests/basic/GHSA-9pqp-7h25-4f32.phpt
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..af819163705
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/basic/GHSA-9pqp-7h25-4f32.phpt
|
||||||
|
@@ -0,0 +1,100 @@
|
||||||
|
+--TEST--
|
||||||
|
+GHSA-9pqp-7h25-4f32
|
||||||
|
+--SKIPIF--
|
||||||
|
+<?php
|
||||||
|
+if (!getenv('TEST_PHP_CGI_EXECUTABLE')) {
|
||||||
|
+ die("skip php-cgi not available");
|
||||||
|
+}
|
||||||
|
+?>
|
||||||
|
+--FILE--
|
||||||
|
+<?php
|
||||||
|
+
|
||||||
|
+const FILLUNIT = 5 * 1024;
|
||||||
|
+
|
||||||
|
+function test($boundaryLen) {
|
||||||
|
+ printf("Boundary len: %d\n", $boundaryLen);
|
||||||
|
+
|
||||||
|
+ $cmd = [
|
||||||
|
+ getenv('TEST_PHP_CGI_EXECUTABLE'),
|
||||||
|
+ '-C',
|
||||||
|
+ '-n',
|
||||||
|
+ __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
|
||||||
|
+ ];
|
||||||
|
+
|
||||||
|
+ $boundary = str_repeat('A', $boundaryLen);
|
||||||
|
+ $body = ""
|
||||||
|
+ . "--$boundary\r\n"
|
||||||
|
+ . "Content-Disposition: form-data; name=\"koko\"\r\n"
|
||||||
|
+ . "\r\n"
|
||||||
|
+ . "BBB\r\n--" . substr($boundary, 0, -1) . "CCC\r\n"
|
||||||
|
+ . "--$boundary--\r\n"
|
||||||
|
+ ;
|
||||||
|
+
|
||||||
|
+ $env = array_merge($_ENV, [
|
||||||
|
+ 'REDIRECT_STATUS' => '1',
|
||||||
|
+ 'CONTENT_TYPE' => "multipart/form-data; boundary=$boundary",
|
||||||
|
+ 'CONTENT_LENGTH' => strlen($body),
|
||||||
|
+ 'REQUEST_METHOD' => 'POST',
|
||||||
|
+ 'SCRIPT_FILENAME' => __DIR__ . '/GHSA-9pqp-7h25-4f32.inc',
|
||||||
|
+ ]);
|
||||||
|
+
|
||||||
|
+ $spec = [
|
||||||
|
+ 0 => ['pipe', 'r'],
|
||||||
|
+ 1 => STDOUT,
|
||||||
|
+ 2 => STDOUT,
|
||||||
|
+ ];
|
||||||
|
+
|
||||||
|
+ $pipes = [];
|
||||||
|
+
|
||||||
|
+ print "Starting...\n";
|
||||||
|
+
|
||||||
|
+ $handle = proc_open($cmd, $spec, $pipes, getcwd(), $env);
|
||||||
|
+
|
||||||
|
+ fwrite($pipes[0], $body);
|
||||||
|
+
|
||||||
|
+ $status = proc_close($handle);
|
||||||
|
+
|
||||||
|
+ print "\n";
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+for ($offset = -1; $offset <= 1; $offset++) {
|
||||||
|
+ test(FILLUNIT - strlen("\r\n--") + $offset);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+?>
|
||||||
|
+--EXPECTF--
|
||||||
|
+Boundary len: 5115
|
||||||
|
+Starting...
|
||||||
|
+X-Powered-By: %s
|
||||||
|
+Content-type: text/html; charset=UTF-8
|
||||||
|
+
|
||||||
|
+Hello world
|
||||||
|
+array(1) {
|
||||||
|
+ ["koko"]=>
|
||||||
|
+ string(5124) "BBB
|
||||||
|
+--AAA%sCCC"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+Boundary len: 5116
|
||||||
|
+Starting...
|
||||||
|
+X-Powered-By: %s
|
||||||
|
+Content-type: text/html; charset=UTF-8
|
||||||
|
+
|
||||||
|
+Hello world
|
||||||
|
+array(1) {
|
||||||
|
+ ["koko"]=>
|
||||||
|
+ string(5125) "BBB
|
||||||
|
+--AAA%sCCC"
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+Boundary len: 5117
|
||||||
|
+Starting...
|
||||||
|
+X-Powered-By: %s
|
||||||
|
+Content-type: text/html; charset=UTF-8
|
||||||
|
+
|
||||||
|
+<br />
|
||||||
|
+<b>Warning</b>: Boundary too large in multipart/form-data POST data in <b>Unknown</b> on line <b>0</b><br />
|
||||||
|
+Hello world
|
||||||
|
+array(0) {
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
--
|
||||||
|
2.46.1
|
||||||
|
|
||||||
|
From c75683864f6e4188439e8ca2adbb05824918be12 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jakub Zelenka <bukka@php.net>
|
||||||
|
Date: Mon, 23 Sep 2024 18:54:31 +0100
|
||||||
|
Subject: [PATCH 7/8] Skip GHSA-9pqp-7h25-4f32 test on Windows
|
||||||
|
|
||||||
|
(cherry picked from commit c70e25630832fa10d421328eed2b8e1a36af7a64)
|
||||||
|
---
|
||||||
|
tests/basic/GHSA-9pqp-7h25-4f32.phpt | 3 +++
|
||||||
|
1 file changed, 3 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/tests/basic/GHSA-9pqp-7h25-4f32.phpt b/tests/basic/GHSA-9pqp-7h25-4f32.phpt
|
||||||
|
index af819163705..29bcb6557d5 100644
|
||||||
|
--- a/tests/basic/GHSA-9pqp-7h25-4f32.phpt
|
||||||
|
+++ b/tests/basic/GHSA-9pqp-7h25-4f32.phpt
|
||||||
|
@@ -5,6 +5,9 @@ GHSA-9pqp-7h25-4f32
|
||||||
|
if (!getenv('TEST_PHP_CGI_EXECUTABLE')) {
|
||||||
|
die("skip php-cgi not available");
|
||||||
|
}
|
||||||
|
+if (substr(PHP_OS, 0, 3) == 'WIN') {
|
||||||
|
+ die("skip not for Windows in CI - probably resource issue");
|
||||||
|
+}
|
||||||
|
?>
|
||||||
|
--FILE--
|
||||||
|
<?php
|
||||||
|
--
|
||||||
|
2.46.1
|
||||||
|
|
||||||
174
php-cve-2024-8926.patch
Normal file
174
php-cve-2024-8926.patch
Normal file
@ -0,0 +1,174 @@
|
|||||||
|
From 9f95e17cc0a9a79da82157e34e3effe1bc395037 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jan Ehrhardt <github@ehrhardt.nl>
|
||||||
|
Date: Wed, 5 Jun 2024 20:44:46 +0200
|
||||||
|
Subject: [PATCH 1/8] Fix GHSA-3qgc-jrrr-25jv
|
||||||
|
|
||||||
|
---
|
||||||
|
sapi/cgi/cgi_main.c | 23 ++++++++++++++-
|
||||||
|
sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt | 38 +++++++++++++++++++++++++
|
||||||
|
2 files changed, 60 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt
|
||||||
|
|
||||||
|
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
|
||||||
|
index 0d52941c5a1..0d3b54ed8b8 100644
|
||||||
|
--- a/sapi/cgi/cgi_main.c
|
||||||
|
+++ b/sapi/cgi/cgi_main.c
|
||||||
|
@@ -1798,8 +1798,13 @@ int main(int argc, char *argv[])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /* Apache CGI will pass the query string to the command line if it doesn't contain a '='.
|
||||||
|
+ * This can create an issue where a malicious request can pass command line arguments to
|
||||||
|
+ * the executable. Ideally we skip argument parsing when we're in cgi or fastcgi mode,
|
||||||
|
+ * but that breaks PHP scripts on Linux with a hashbang: `#!/php-cgi -d option=value`.
|
||||||
|
+ * Therefore, this code only prevents passing arguments if the query string starts with a '-'.
|
||||||
|
+ * Similarly, scripts spawned in subprocesses on Windows may have the same issue. */
|
||||||
|
if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
|
||||||
|
- /* we've got query string that has no = - apache CGI will pass it to command line */
|
||||||
|
unsigned char *p;
|
||||||
|
decoded_query_string = strdup(query_string);
|
||||||
|
php_url_decode(decoded_query_string, strlen(decoded_query_string));
|
||||||
|
@@ -1809,6 +1814,22 @@ int main(int argc, char *argv[])
|
||||||
|
if(*p == '-') {
|
||||||
|
skip_getopt = 1;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ /* On Windows we have to take into account the "best fit" mapping behaviour. */
|
||||||
|
+#ifdef PHP_WIN32
|
||||||
|
+ if (*p >= 0x80) {
|
||||||
|
+ wchar_t wide_buf[1];
|
||||||
|
+ wide_buf[0] = *p;
|
||||||
|
+ char char_buf[4];
|
||||||
|
+ size_t wide_buf_len = sizeof(wide_buf) / sizeof(wide_buf[0]);
|
||||||
|
+ size_t char_buf_len = sizeof(char_buf) / sizeof(char_buf[0]);
|
||||||
|
+ if (WideCharToMultiByte(CP_ACP, 0, wide_buf, wide_buf_len, char_buf, char_buf_len, NULL, NULL) == 0
|
||||||
|
+ || char_buf[0] == '-') {
|
||||||
|
+ skip_getopt = 1;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
free(decoded_query_string);
|
||||||
|
}
|
||||||
|
|
||||||
|
diff --git a/sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt b/sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..fd2fcdfbf89
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sapi/cgi/tests/ghsa-3qgc-jrrr-25jv.phpt
|
||||||
|
@@ -0,0 +1,38 @@
|
||||||
|
+--TEST--
|
||||||
|
+GHSA-3qgc-jrrr-25jv
|
||||||
|
+--SKIPIF--
|
||||||
|
+<?php
|
||||||
|
+include 'skipif.inc';
|
||||||
|
+if (PHP_OS_FAMILY !== "Windows") die("skip Only for Windows");
|
||||||
|
+
|
||||||
|
+$codepage = trim(shell_exec("powershell Get-ItemPropertyValue HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Nls\\CodePage ACP"));
|
||||||
|
+if ($codepage !== '932' && $codepage !== '936' && $codepage !== '950') die("skip Wrong codepage");
|
||||||
|
+?>
|
||||||
|
+--FILE--
|
||||||
|
+<?php
|
||||||
|
+include 'include.inc';
|
||||||
|
+
|
||||||
|
+$filename = __DIR__."/GHSA-3qgc-jrrr-25jv_tmp.php";
|
||||||
|
+$script = '<?php echo "hello "; echo "world"; ?>';
|
||||||
|
+file_put_contents($filename, $script);
|
||||||
|
+
|
||||||
|
+$php = get_cgi_path();
|
||||||
|
+reset_env_vars();
|
||||||
|
+
|
||||||
|
+putenv("SERVER_NAME=Test");
|
||||||
|
+putenv("SCRIPT_FILENAME=$filename");
|
||||||
|
+putenv("QUERY_STRING=%ads");
|
||||||
|
+putenv("REDIRECT_STATUS=1");
|
||||||
|
+
|
||||||
|
+passthru("$php -s");
|
||||||
|
+
|
||||||
|
+?>
|
||||||
|
+--CLEAN--
|
||||||
|
+<?php
|
||||||
|
+@unlink(__DIR__."/GHSA-3qgc-jrrr-25jv_tmp.php");
|
||||||
|
+?>
|
||||||
|
+--EXPECTF--
|
||||||
|
+X-Powered-By: PHP/%s
|
||||||
|
+Content-type: %s
|
||||||
|
+
|
||||||
|
+hello world
|
||||||
|
--
|
||||||
|
2.46.1
|
||||||
|
|
||||||
|
From 2d2552e092b6ff32cd823692d512f126ee629842 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
|
||||||
|
Date: Fri, 14 Jun 2024 19:49:22 +0200
|
||||||
|
Subject: [PATCH 4/8] Fix GHSA-p99j-rfp4-xqvq
|
||||||
|
|
||||||
|
It's no use trying to work around whatever the operating system and Apache
|
||||||
|
do because we'll be fighting that until eternity.
|
||||||
|
Change the skip_getopt condition such that when we're running in
|
||||||
|
CGI or FastCGI mode we always skip the argument parsing.
|
||||||
|
This is a BC break, but this seems to be the only way to get rid of this
|
||||||
|
class of issues.
|
||||||
|
|
||||||
|
(cherry picked from commit abcfd980bfa03298792fd3aba051c78d52f10642)
|
||||||
|
---
|
||||||
|
sapi/cgi/cgi_main.c | 26 ++++++++------------------
|
||||||
|
1 file changed, 8 insertions(+), 18 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
|
||||||
|
index 0d3b54ed8b8..6e148874e4f 100644
|
||||||
|
--- a/sapi/cgi/cgi_main.c
|
||||||
|
+++ b/sapi/cgi/cgi_main.c
|
||||||
|
@@ -1748,7 +1748,6 @@ int main(int argc, char *argv[])
|
||||||
|
int status = 0;
|
||||||
|
#endif
|
||||||
|
char *query_string;
|
||||||
|
- char *decoded_query_string;
|
||||||
|
int skip_getopt = 0;
|
||||||
|
|
||||||
|
#if defined(SIGPIPE) && defined(SIG_IGN)
|
||||||
|
@@ -1803,10 +1802,15 @@ int main(int argc, char *argv[])
|
||||||
|
* the executable. Ideally we skip argument parsing when we're in cgi or fastcgi mode,
|
||||||
|
* but that breaks PHP scripts on Linux with a hashbang: `#!/php-cgi -d option=value`.
|
||||||
|
* Therefore, this code only prevents passing arguments if the query string starts with a '-'.
|
||||||
|
- * Similarly, scripts spawned in subprocesses on Windows may have the same issue. */
|
||||||
|
+ * Similarly, scripts spawned in subprocesses on Windows may have the same issue.
|
||||||
|
+ * However, Windows has lots of conversion rules and command line parsing rules that
|
||||||
|
+ * are too difficult and dangerous to reliably emulate. */
|
||||||
|
if((query_string = getenv("QUERY_STRING")) != NULL && strchr(query_string, '=') == NULL) {
|
||||||
|
+#ifdef PHP_WIN32
|
||||||
|
+ skip_getopt = cgi || fastcgi;
|
||||||
|
+#else
|
||||||
|
unsigned char *p;
|
||||||
|
- decoded_query_string = strdup(query_string);
|
||||||
|
+ char *decoded_query_string = strdup(query_string);
|
||||||
|
php_url_decode(decoded_query_string, strlen(decoded_query_string));
|
||||||
|
for (p = (unsigned char *)decoded_query_string; *p && *p <= ' '; p++) {
|
||||||
|
/* skip all leading spaces */
|
||||||
|
@@ -1815,22 +1819,8 @@ int main(int argc, char *argv[])
|
||||||
|
skip_getopt = 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
- /* On Windows we have to take into account the "best fit" mapping behaviour. */
|
||||||
|
-#ifdef PHP_WIN32
|
||||||
|
- if (*p >= 0x80) {
|
||||||
|
- wchar_t wide_buf[1];
|
||||||
|
- wide_buf[0] = *p;
|
||||||
|
- char char_buf[4];
|
||||||
|
- size_t wide_buf_len = sizeof(wide_buf) / sizeof(wide_buf[0]);
|
||||||
|
- size_t char_buf_len = sizeof(char_buf) / sizeof(char_buf[0]);
|
||||||
|
- if (WideCharToMultiByte(CP_ACP, 0, wide_buf, wide_buf_len, char_buf, char_buf_len, NULL, NULL) == 0
|
||||||
|
- || char_buf[0] == '-') {
|
||||||
|
- skip_getopt = 1;
|
||||||
|
- }
|
||||||
|
- }
|
||||||
|
-#endif
|
||||||
|
-
|
||||||
|
free(decoded_query_string);
|
||||||
|
+#endif
|
||||||
|
}
|
||||||
|
|
||||||
|
while (!skip_getopt && (c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0, 2)) != -1) {
|
||||||
|
--
|
||||||
|
2.46.1
|
||||||
|
|
||||||
56
php-cve-2024-8927.patch
Normal file
56
php-cve-2024-8927.patch
Normal file
@ -0,0 +1,56 @@
|
|||||||
|
From 8aa748ee0657cdee8d883ba50d04b68bc450f686 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
|
||||||
|
Date: Tue, 18 Jun 2024 21:28:26 +0200
|
||||||
|
Subject: [PATCH 5/8] Fix GHSA-94p6-54jq-9mwp
|
||||||
|
|
||||||
|
Apache only generates REDIRECT_STATUS, so explicitly check for that
|
||||||
|
if the server name is Apache, don't allow other variable names.
|
||||||
|
Furthermore, redirect.so and Netscape no longer exist, so
|
||||||
|
remove those entries as we can't check their server name anymore.
|
||||||
|
|
||||||
|
We now also check for the configuration override *first* such that it
|
||||||
|
always take precedence. This would allow for a mitigation path if
|
||||||
|
something like this happens in the future.
|
||||||
|
|
||||||
|
(cherry picked from commit 48808d98f4fc2a05193cdcc1aedd6c66816450f1)
|
||||||
|
---
|
||||||
|
sapi/cgi/cgi_main.c | 23 +++++++++++------------
|
||||||
|
1 file changed, 11 insertions(+), 12 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/sapi/cgi/cgi_main.c b/sapi/cgi/cgi_main.c
|
||||||
|
index 6e148874e4f..5879d0e0f93 100644
|
||||||
|
--- a/sapi/cgi/cgi_main.c
|
||||||
|
+++ b/sapi/cgi/cgi_main.c
|
||||||
|
@@ -1910,18 +1910,17 @@ int main(int argc, char *argv[])
|
||||||
|
|
||||||
|
/* check force_cgi after startup, so we have proper output */
|
||||||
|
if (cgi && CGIG(force_redirect)) {
|
||||||
|
- /* Apache will generate REDIRECT_STATUS,
|
||||||
|
- * Netscape and redirect.so will generate HTTP_REDIRECT_STATUS.
|
||||||
|
- * redirect.so and installation instructions available from
|
||||||
|
- * http://www.koehntopp.de/php.
|
||||||
|
- * -- kk@netuse.de
|
||||||
|
- */
|
||||||
|
- if (!getenv("REDIRECT_STATUS") &&
|
||||||
|
- !getenv ("HTTP_REDIRECT_STATUS") &&
|
||||||
|
- /* this is to allow a different env var to be configured
|
||||||
|
- * in case some server does something different than above */
|
||||||
|
- (!CGIG(redirect_status_env) || !getenv(CGIG(redirect_status_env)))
|
||||||
|
- ) {
|
||||||
|
+ /* This is to allow a different environment variable to be configured
|
||||||
|
+ * in case the we cannot auto-detect which environment variable to use.
|
||||||
|
+ * Checking this first to allow user overrides in case the environment
|
||||||
|
+ * variable can be set by an untrusted party. */
|
||||||
|
+ const char *redirect_status_env = CGIG(redirect_status_env);
|
||||||
|
+ if (!redirect_status_env) {
|
||||||
|
+ /* Apache will generate REDIRECT_STATUS. */
|
||||||
|
+ redirect_status_env = "REDIRECT_STATUS";
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (!getenv(redirect_status_env)) {
|
||||||
|
zend_try {
|
||||||
|
SG(sapi_headers).http_response_code = 400;
|
||||||
|
PUTS("<b>Security Alert!</b> The PHP CGI cannot be accessed directly.\n\n\
|
||||||
|
--
|
||||||
|
2.46.1
|
||||||
|
|
||||||
136
php-cve-2024-9026.patch
Normal file
136
php-cve-2024-9026.patch
Normal file
@ -0,0 +1,136 @@
|
|||||||
|
From 22f4d3504d7613ce78bb96aa53cbfe7d672fa036 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jakub Zelenka <bukka@php.net>
|
||||||
|
Date: Thu, 12 Sep 2024 13:11:11 +0100
|
||||||
|
Subject: [PATCH 6/8] Fix GHSA-865w-9rf3-2wh5: FPM: Logs from childrens may be
|
||||||
|
altered
|
||||||
|
|
||||||
|
(cherry picked from commit 1f8e16172c7961045c2b0f34ba7613e3f21cdee8)
|
||||||
|
---
|
||||||
|
sapi/fpm/fpm/fpm_stdio.c | 2 +-
|
||||||
|
.../log-bwp-msg-flush-split-sep-pos-end.phpt | 47 +++++++++++++++++++
|
||||||
|
...log-bwp-msg-flush-split-sep-pos-start.phpt | 47 +++++++++++++++++++
|
||||||
|
3 files changed, 95 insertions(+), 1 deletion(-)
|
||||||
|
create mode 100644 sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-end.phpt
|
||||||
|
create mode 100644 sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-start.phpt
|
||||||
|
|
||||||
|
diff --git a/sapi/fpm/fpm/fpm_stdio.c b/sapi/fpm/fpm/fpm_stdio.c
|
||||||
|
index d75f9158cda..7983d6217b2 100644
|
||||||
|
--- a/sapi/fpm/fpm/fpm_stdio.c
|
||||||
|
+++ b/sapi/fpm/fpm/fpm_stdio.c
|
||||||
|
@@ -228,7 +228,7 @@ stdio_read:
|
||||||
|
if ((sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos) <= in_buf &&
|
||||||
|
!memcmp(buf, &FPM_STDIO_CMD_FLUSH[cmd_pos], sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos)) {
|
||||||
|
zlog_stream_finish(log_stream);
|
||||||
|
- start = cmd_pos;
|
||||||
|
+ start = sizeof(FPM_STDIO_CMD_FLUSH) - cmd_pos;
|
||||||
|
} else {
|
||||||
|
zlog_stream_str(log_stream, &FPM_STDIO_CMD_FLUSH[0], cmd_pos);
|
||||||
|
}
|
||||||
|
diff --git a/sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-end.phpt b/sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-end.phpt
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..52826320080
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-end.phpt
|
||||||
|
@@ -0,0 +1,47 @@
|
||||||
|
+--TEST--
|
||||||
|
+FPM: Buffered worker output plain log with msg with flush split position towards separator end
|
||||||
|
+--SKIPIF--
|
||||||
|
+<?php include "skipif.inc"; ?>
|
||||||
|
+--FILE--
|
||||||
|
+<?php
|
||||||
|
+
|
||||||
|
+require_once "tester.inc";
|
||||||
|
+
|
||||||
|
+$cfg = <<<EOT
|
||||||
|
+[global]
|
||||||
|
+error_log = {{FILE:LOG}}
|
||||||
|
+[unconfined]
|
||||||
|
+listen = {{ADDR}}
|
||||||
|
+pm = dynamic
|
||||||
|
+pm.max_children = 5
|
||||||
|
+pm.start_servers = 1
|
||||||
|
+pm.min_spare_servers = 1
|
||||||
|
+pm.max_spare_servers = 3
|
||||||
|
+catch_workers_output = yes
|
||||||
|
+decorate_workers_output = no
|
||||||
|
+EOT;
|
||||||
|
+
|
||||||
|
+$code = <<<EOT
|
||||||
|
+<?php
|
||||||
|
+file_put_contents('php://stderr', str_repeat('a', 1013) . "Quarkslab\0fscf\0Quarkslab");
|
||||||
|
+EOT;
|
||||||
|
+
|
||||||
|
+$tester = new FPM\Tester($cfg, $code);
|
||||||
|
+$tester->start();
|
||||||
|
+$tester->expectLogStartNotices();
|
||||||
|
+$tester->request()->expectEmptyBody();
|
||||||
|
+$tester->expectLogLine(str_repeat('a', 1013) . "Quarkslab", decorated: false);
|
||||||
|
+$tester->expectLogLine("Quarkslab", decorated: false);
|
||||||
|
+$tester->terminate();
|
||||||
|
+$tester->expectLogTerminatingNotices();
|
||||||
|
+$tester->close();
|
||||||
|
+
|
||||||
|
+?>
|
||||||
|
+Done
|
||||||
|
+--EXPECT--
|
||||||
|
+Done
|
||||||
|
+--CLEAN--
|
||||||
|
+<?php
|
||||||
|
+require_once "tester.inc";
|
||||||
|
+FPM\Tester::clean();
|
||||||
|
+?>
|
||||||
|
diff --git a/sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-start.phpt b/sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-start.phpt
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000000..34905938553
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sapi/fpm/tests/log-bwp-msg-flush-split-sep-pos-start.phpt
|
||||||
|
@@ -0,0 +1,47 @@
|
||||||
|
+--TEST--
|
||||||
|
+FPM: Buffered worker output plain log with msg with flush split position towards separator start
|
||||||
|
+--SKIPIF--
|
||||||
|
+<?php include "skipif.inc"; ?>
|
||||||
|
+--FILE--
|
||||||
|
+<?php
|
||||||
|
+
|
||||||
|
+require_once "tester.inc";
|
||||||
|
+
|
||||||
|
+$cfg = <<<EOT
|
||||||
|
+[global]
|
||||||
|
+error_log = {{FILE:LOG}}
|
||||||
|
+[unconfined]
|
||||||
|
+listen = {{ADDR}}
|
||||||
|
+pm = dynamic
|
||||||
|
+pm.max_children = 5
|
||||||
|
+pm.start_servers = 1
|
||||||
|
+pm.min_spare_servers = 1
|
||||||
|
+pm.max_spare_servers = 3
|
||||||
|
+catch_workers_output = yes
|
||||||
|
+decorate_workers_output = no
|
||||||
|
+EOT;
|
||||||
|
+
|
||||||
|
+$code = <<<EOT
|
||||||
|
+<?php
|
||||||
|
+file_put_contents('php://stderr', str_repeat('a', 1009) . "Quarkslab\0fscf\0Quarkslab");
|
||||||
|
+EOT;
|
||||||
|
+
|
||||||
|
+$tester = new FPM\Tester($cfg, $code);
|
||||||
|
+$tester->start();
|
||||||
|
+$tester->expectLogStartNotices();
|
||||||
|
+$tester->request()->expectEmptyBody();
|
||||||
|
+$tester->expectLogLine(str_repeat('a', 1009) . "Quarkslab", decorated: false);
|
||||||
|
+$tester->expectLogLine("Quarkslab", decorated: false);
|
||||||
|
+$tester->terminate();
|
||||||
|
+$tester->expectLogTerminatingNotices();
|
||||||
|
+$tester->close();
|
||||||
|
+
|
||||||
|
+?>
|
||||||
|
+Done
|
||||||
|
+--EXPECT--
|
||||||
|
+Done
|
||||||
|
+--CLEAN--
|
||||||
|
+<?php
|
||||||
|
+require_once "tester.inc";
|
||||||
|
+FPM\Tester::clean();
|
||||||
|
+?>
|
||||||
|
--
|
||||||
|
2.46.1
|
||||||
13
php.spec
13
php.spec
@ -26,7 +26,7 @@
|
|||||||
|
|
||||||
Name: php
|
Name: php
|
||||||
Version: %{upver}
|
Version: %{upver}
|
||||||
Release: 5
|
Release: 6
|
||||||
Summary: PHP scripting language for creating dynamic web sites
|
Summary: PHP scripting language for creating dynamic web sites
|
||||||
License: PHP-3.01 AND Zend-2.0 AND BSD-2-Clause AND MIT AND Apache-1.0 AND NCSA AND BSL-1.0
|
License: PHP-3.01 AND Zend-2.0 AND BSD-2-Clause AND MIT AND Apache-1.0 AND NCSA AND BSL-1.0
|
||||||
URL: http://www.php.net/
|
URL: http://www.php.net/
|
||||||
@ -59,6 +59,10 @@ Patch8: php-Add-sw64-architecture.patch
|
|||||||
Patch9: php-cve-2024-2756.patch
|
Patch9: php-cve-2024-2756.patch
|
||||||
Patch10: php-cve-2024-3096.patch
|
Patch10: php-cve-2024-3096.patch
|
||||||
Patch11: php-cve-2024-5458.patch
|
Patch11: php-cve-2024-5458.patch
|
||||||
|
Patch12: php-cve-2024-8925.patch
|
||||||
|
Patch13: php-cve-2024-8926.patch
|
||||||
|
Patch14: php-cve-2024-8927.patch
|
||||||
|
Patch15: php-cve-2024-9026.patch
|
||||||
|
|
||||||
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
||||||
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
||||||
@ -342,9 +346,9 @@ support for multi-byte string handling to PHP.
|
|||||||
%package gd
|
%package gd
|
||||||
Summary: A module for PHP applications for using the gd graphics library
|
Summary: A module for PHP applications for using the gd graphics library
|
||||||
%if %{with_libgd}
|
%if %{with_libgd}
|
||||||
License: PHP-3.0.1
|
License: PHP-3.01
|
||||||
%else
|
%else
|
||||||
License: PHP-3.0.1 and BSD-2-Clause
|
License: PHP-3.01 and BSD-2-Clause
|
||||||
%endif
|
%endif
|
||||||
Requires: php-common%{?_isa} = %{version}-%{release}
|
Requires: php-common%{?_isa} = %{version}-%{release}
|
||||||
%if %{with_libgd}
|
%if %{with_libgd}
|
||||||
@ -1086,6 +1090,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Sep 27 2024 Funda Wang <fundawang@yeah.net> - 8.0.30-6
|
||||||
|
- fix CVE-2024-8925, CVE-2024-8926, CVE-2024-8927, CVE-2024-9026
|
||||||
|
|
||||||
* Wed Jun 12 2024 Funda Wang <fundawang@yeah.net> - 8.0.30-5
|
* Wed Jun 12 2024 Funda Wang <fundawang@yeah.net> - 8.0.30-5
|
||||||
- Update licenses declaration
|
- Update licenses declaration
|
||||||
|
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user