Denial of Service Vulnerability in php5 Package - CVE-2018-19158
Summary
ALPINE-CVE-2018-19158: ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount of stake/coins in the system. Affects php5 versions < 5.6.39-r0. Fixed in 5.6.39-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php5 package in Alpine Linux is a widely used implementation of the PHP programming language, which is essential for web development and server-side scripting. This package allows developers to create dynamic web applications and is integral to many web servers. However, vulnerabilities in this package can lead to severe security issues, including denial of service attacks that can disrupt service availability.
Vulnerability Detail
CVE-2018-19158 is a vulnerability found in ColossusCoinXT versions up to 1.0.5, which is a chain-based proof-of-stake cryptocurrency. This vulnerability allows an attacker, who acquires even a small amount of stake or coins, to send invalid headers or blocks to a victim's node. These invalid entries are stored on the victim's disk, leading to a denial of service condition. The potential ramifications include service disruption and loss of availability for users relying on the affected system.
How To Fix
Minimum fixed version
5.6.39-r0
This is the first release that contains the fix.
sudo apk add --upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the exposure of your system by implementing network-level controls to filter out invalid headers and blocks. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The CVE-2018-19158 vulnerability in the php5 package poses a significant risk of denial of service attacks. It is crucial for users to update to the patched version to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for php5 →
FAQ
CVE-2018-19158 is a vulnerability that allows for a remote denial of service attack in the php5 package of Alpine Linux.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The main consequence is a denial of service, which can disrupt the availability of services relying on the php5 package.
Yes, the patch is available in version 5.6.39-r0 of the php5 package. Updating to this version will resolve the vulnerability.
Vulert is a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It provides real-time alerts without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for php5.
