Critical Resource Exhaustion Vulnerability in PHP Packages
Summary
UBUNTU-CVE-2023-0662: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use and flexibility, allowing developers to create dynamic web pages and applications. The affected packages include various versions of PHP (5, 7.0, 7.2, 7.4, and 8.1) that are integral to many web applications. This vulnerability can lead to significant resource consumption, potentially causing denial of service (DoS) on servers running these PHP versions.
Vulnerability Detail
In PHP versions 8.0.X before 8.0.28, 8.1.X before 8.1.16, and 8.2.X before 8.2.3, an excessive number of parts in HTTP form uploads can lead to high resource consumption and an excessive number of log entries. This can exhaust CPU resources or disk space, resulting in a denial of service on the affected server. The vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the maximum number of parts in HTTP form uploads by configuring the 'post_max_size' and 'upload_max_filesize' directives in the php.ini file. For example, you can set: 'post_max_size = 8M' and 'upload_max_filesize = 2M' to restrict the size of uploads.
Conclusion
This report outlines a critical vulnerability affecting multiple PHP versions that can lead to denial of service due to excessive resource consumption. It is crucial to update to the latest patched versions to mitigate risks. Additionally, temporary workarounds can help manage the situation until updates are applied.
See every vulnerability recorded for php5 →
FAQ
The vulnerability can lead to denial of service by exhausting server resources, which may disrupt the availability of web applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Affected versions include PHP 5.5.9, 7.0.33, 7.2.24, 7.4.3, and 8.1.2, among others.
Yes, you can configure your PHP settings to limit the size of uploads as a temporary measure.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
