CVE-2024-9026
published 2024-10-08CVE-2024-9026: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through…
PriorityP412low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.49%
40.4th percentile
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | < php7.4 7.4.33-1+deb11u6 (bullseye) | php7.4 7.4.33-1+deb11u6 (bullseye) |
| debian | php8.2 | < php7.4 7.4.33-1+deb11u6 (bullseye) | php7.4 7.4.33-1+deb11u6 (bullseye) |
| msrc | azl3_php_8.3.12-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.8-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_php_8.1.29-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.30-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| php | php | >= 8.1.0 < 8.1.30 | 8.1.30 |
| php | php | >= 8.2.0 < 8.2.24 | 8.2.24 |
| php | php | >= 8.3.0 < 8.3.12 | 8.3.12 |
| php_group | php | >= 8.1.* < 8.1.30 | 8.1.30 |
| php_group | php | >= 8.2.* < 8.2.24 | 8.2.24 |
| php_group | php | >= 8.3.* < 8.3.12 | 8.3.12 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM
vendor_debian3.3LOW
vendor_msrc3.3LOW
vendor_redhat3.3LOW
vendor_ubuntu3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-9026: In PHP versions 8
osv·2024-10-08·CVSS 3.3
CVE-2024-9026 [LOW] CVE-2024-9026: In PHP versions 8
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
OSV
php7.4, php8.1, php8.3 vulnerabilities
osv·2024-10-01·CVSS 5.3
CVE-2024-8925 [MEDIUM] php7.4, php8.1, php8.3 vulnerabilities
php7.4, php8.1, php8.3 vulnerabilities
It was discovered that PHP incorrectly handled parsing multipart form data.
A remote attacker could possibly use this issue to inject payloads and
cause PHP to ignore legitimate data. (CVE-2024-8925)
It was discovered that PHP incorrectly handled the cgi.force_redirect
configuration option due to environment variable collisions. In certain
configurations, an attacker could possibly use this issue bypass
force_redirect restrictions. (CVE-2024-8927)
It was discovered that PHP-FPM incorrectly handled logging. A remote
attacker could possibly use this issue to alter and inject arbitrary
contents into log files. This issue only affected Ubuntu 22.04 LTS, and
Ubuntu 24.04 LTS. (CVE-2024-9026)
Microsoft
PHP-FPM logs from children may be altered
vendor_msrc·2024-10-08·CVSS 3.3
CVE-2024-9026 [LOW] CWE-158 PHP-FPM logs from children may be altered
PHP-FPM logs from children may be altered
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-
Red Hat
php: PHP-FPM Log Manipulation Vulnerability
vendor_redhat·2024-10-08·CVSS 3.3
CVE-2024-9026 [LOW] CWE-117 php: PHP-FPM Log Manipulation Vulnerability
php: PHP-FPM Log Manipulation Vulnerability
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
A flaw was found in PHP-FPM, the FastCGI Process Manager. This vulnerability can allow an attacker to manipulate or remove up to 4 characters from log messages via crafted log content, potentially polluting or altering the final log. If PHP-FPM is configured to use syslog output, further log data man
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2024-10-01·CVSS 3.1
CVE-2024-8927 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled parsing multipart form data.
A remote attacker could possibly use this issue to inject payloads and
cause PHP to ignore legitimate data. (CVE-2024-8925)
It was discovered that PHP incorrectly handled the cgi.force_redirect
configuration option due to environment variable collisions. In certain
configurations, an attacker could possibly use this issue bypass
force_redirect restrictions. (CVE-2024-8927)
It was discovered that PHP-FPM incorrectly handled logging. A remote
attacker could possibly use this issue to alter and inject arbitrary
contents into log files. This issue only affected Ubuntu 22.04 LTS, and
Ubuntu 24.04 LTS. (CVE-2024-9026)
Instructions: In gen
Debian
CVE-2024-9026: php7.4 - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, w...
vendor_debian·2024·CVSS 3.3
CVE-2024-9026 [LOW] CVE-2024-9026: php7.4 - In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, w...
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
Scope: local
bullseye: resolved (fixed in 7.4.33-1+deb11u6)
No detection rules found.
No public exploits indexed.
2024-10-08
Published