Vulnerability in php-pecl-http - security update
Summary
DLA-1929-1: php-pecl-http - security update. Affects php-pecl-http versions < 2.0.4-1+deb8u1. Fixed in 2.0.4-1+deb8u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php-pecl-http package is an extension module for PHP 5 that provides extended HTTP support. It allows PHP applications to perform various HTTP-related tasks such as sending requests, handling responses, and managing cookies. This package is widely used in web development projects to interact with HTTP services.
However, a vulnerability has been discovered in php-pecl-http version 2.0.4-1+deb8u1 and earlier. This vulnerability is a type confusion issue in the merge_param() function, which can be exploited by attackers to crash PHP and potentially execute arbitrary code. It can be triggered by crafting malicious HTTP requests.
Vulnerability Detail
The type confusion vulnerability in php-pecl-http's merge_param() function allows attackers to crash PHP and potentially execute arbitrary code. By sending specially crafted HTTP requests, an attacker can exploit this vulnerability and cause the PHP interpreter to mishandle memory, leading to a crash or even remote code execution. This can have severe consequences, including unauthorized access to sensitive data, server compromise, and potential further exploitation of the affected system.
How To Fix
Minimum fixed version
2.0.4-1+deb8u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-pecl-httpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the php-pecl-http package is vulnerable to a type confusion issue in the merge_param() function, which can be exploited to crash PHP and potentially execute arbitrary code. To mitigate this risk, it is crucial to upgrade the package to version 2.0.4-1+deb8u1 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php-pecl-http →
FAQ
php-pecl-http is a PHP extension module that provides extended HTTP support for PHP applications. It allows developers to interact with HTTP services, send requests, handle responses, and manage cookies.
This vulnerability in php-pecl-http can lead to a crash of the PHP interpreter and potentially allow attackers to execute arbitrary code. This can result in unauthorized access to sensitive data, server compromise, and further exploitation of the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
No, there is no known workaround for this vulnerability. It is recommended to upgrade the php-pecl-http package to the fixed version as soon as possible.
You can find more information about this vulnerability in the Debian LTS security advisory DLA-1929-1 at https://storage.googleapis.com/debian-osv/dla-osv/DLA-1929-1.json.
Related vulnerabilities
Recent vulnerabilities recorded for php-pecl-http.
