CVE-2024-9026: PHP-FPM logs from children may be altered
Fixed bug (Logs from childrens may be altered). (CVE-2024-9026)
Other sources
In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
— Red Hat
PHP-FPM logs from children may be altered
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.3.12 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u8 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.26-1~deb12u1Fixed in 8.2.28-1~deb12u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.2.24 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.3.12 - Configuration
If using PHP-FPM SAPI, set catch_workers_output = no to avoid catching workers output (the vulnerability requires catch_workers_output = yes to pollute the final log / remove up to 4 characters).
PHP-FPM (catch_workers_output) catch_workers_output = no
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9026?
CVE-2024-9026 has a medium severity rating due to the potential for log pollution in PHP-FPM configurations.
How do I fix CVE-2024-9026?
To fix CVE-2024-9026, upgrade PHP-FPM to versions 8.1.30, 8.2.24, or 8.3.12 or higher.
Which PHP versions are affected by CVE-2024-9026?
CVE-2024-9026 affects PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12.
What is the primary issue caused by CVE-2024-9026?
The primary issue of CVE-2024-9026 is the potential alteration and pollution of logs when using PHP-FPM with catch_workers_output enabled.
Are there any recommended remediation steps for CVE-2024-9026?
The recommended remediation steps for CVE-2024-9026 include upgrading to the latest, patched versions of PHP-FPM.