CVE-2023-3823: Security issue with external entity loading in XML without enabling it
Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
Other sources
In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.20-1~deb12u1Fixed in 8.2.23-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.0.30 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.2.9 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.1.22 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.0.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.8-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.22-1 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.0.30 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.1.22 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 8.2.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-3qrf-m4j2-pcrr
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2023-3823.
What is the severity of CVE-2023-3823?
CVE-2023-3823 has a severity value of 7.5, which is considered high.
Which versions of PHP are affected by CVE-2023-3823?
PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 are affected by CVE-2023-3823.
How can I fix CVE-2023-3823?
To fix CVE-2023-3823, upgrade to PHP version 8.2.9 or higher.
Where can I find more information about CVE-2023-3823?
You can find more information about CVE-2023-3823 in the [PHP ChangeLog](https://www.php.net/ChangeLog-8.php#8.2.9), [CVE Details](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3823), and [GitHub Advisory](https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr).