CVE-2017-7189: Input Validation
main/streams/xpsocket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7189?
CVE-2017-7189 has a medium severity rating due to potential security risks in misparsing fsockopen calls.
How do I fix CVE-2017-7189?
To fix CVE-2017-7189, upgrade PHP to version 7.0.16 or later.
What versions of PHP are affected by CVE-2017-7189?
CVE-2017-7189 affects PHP versions 7.0.0 to 7.0.16.
What is the impact of CVE-2017-7189 on PHP applications?
The impact of CVE-2017-7189 could lead to unintended behavior in socket connections, which may expose applications to vulnerabilities.
Is CVE-2017-7189 related to socket programming in PHP?
Yes, CVE-2017-7189 specifically relates to misparsing in fsockopen calls used in socket programming in PHP.