CVE-2024-34515: image-optimizer allows PHAR deserialization
image-optimizer allows PHAR deserialization
Other sources
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to fileexists().
— GitHub
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to fileexists().
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/spatie/image-optimizerto a version that resolves this vulnerability.Fixed in 1.7.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34515?
CVE-2024-34515 has a high severity due to the risk of remote code execution through PHAR deserialization.
How do I fix CVE-2024-34515?
To fix CVE-2024-34515, upgrade to version 1.7.3 or later of the spatie/image-optimizer package.
What software is affected by CVE-2024-34515?
CVE-2024-34515 affects the spatie/image-optimizer package versions prior to 1.7.3.
What is PHAR deserialization in the context of CVE-2024-34515?
PHAR deserialization in CVE-2024-34515 refers to an exploit that triggers vulnerabilities when PHAR files are incorrectly handled.
What specific function is mentioned in CVE-2024-34515 as being vulnerable?
The vulnerable function mentioned in CVE-2024-34515 is `file_exists()`, which improperly handles the `phar://` protocol.