REDHAT-BUG-1786572
First published: Thu Dec 26 2019(Updated: )
A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access. Reference: <a href="https://bugs.php.net/bug.php?id=78863">https://bugs.php.net/bug.php?id=78863</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP | <7.2.26 | |
| PHP | <7.3.13 | |
| PHP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.php.net/bug.php?id=78863
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1786573
- http://git.php.net/?p=php-src.git;a=commit;h=a5a15965da23c8e97657278fc8dfbf1dfb20c016
- https://access.redhat.com/errata/RHSA-2020:3662
- https://access.redhat.com/security/cve/cve-2019-11045
- https://access.redhat.com/errata/RHSA-2020:5275
- https://bugzilla.redhat.com/show_bug.cgi?id=1786572
Frequently Asked Questions
What is the severity of REDHAT-BUG-1786572?
The severity of REDHAT-BUG-1786572 is considered high due to potential security vulnerabilities that could arise from improper path handling in affected PHP versions.
How do I fix REDHAT-BUG-1786572?
To fix REDHAT-BUG-1786572, update PHP to version 7.2.26, 7.3.13, or later.
Which PHP versions are affected by REDHAT-BUG-1786572?
PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 are affected by REDHAT-BUG-1786572.
What is the impact of REDHAT-BUG-1786572 on applications?
The impact of REDHAT-BUG-1786572 could lead to security vulnerabilities in applications that handle filenames with embedded \0 bytes.
Is there a workaround for REDHAT-BUG-1786572?
There are no well-documented workarounds for REDHAT-BUG-1786572; updating to a secure version is the recommended solution.
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11045
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/php
- canonical/php