Critical Denial-of-Service Vulnerability in PHP5 due to Oniguruma Library Flaw
Summary
ALPINE-CVE-2017-9229: An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. Affects php5 versions < 5.6.31-r0. Fixed in 5.6.31-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP5 is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. However, PHP5 has been found to be vulnerable to a critical issue stemming from the Oniguruma library, which is responsible for regular expression handling. This vulnerability can lead to severe service disruptions, making it crucial for users to address it promptly.
Vulnerability Detail
An issue was discovered in Oniguruma 6.2.0, which is utilized in PHP5. The vulnerability arises during regular expression compilation in the left_adjust_char_head() function, leading to a SIGSEGV (segmentation fault). This flaw in the handling of reg->dmax in the forward_search_range() function can result in an invalid pointer dereference, causing an immediate denial-of-service condition. The vulnerability affects PHP5 versions prior to 5.6.31-r0, making it imperative for users to update their installations to mitigate potential risks.
How To Fix
Minimum fixed version
5.6.31-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using regular expressions that may trigger this vulnerability until the package is updated. However, this is not a permanent solution and should only be considered until the patch is applied.
Conclusion
The vulnerability in PHP5 due to the Oniguruma library poses a significant risk of denial-of-service attacks. Users are strongly advised to update their PHP5 installations to the patched version 5.6.31-r0 to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for php5 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
PHP5 versions prior to 5.6.31-r0 are affected by this vulnerability.
The vulnerability can lead to a denial-of-service condition, causing the affected application to crash and become unavailable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
