REDHAT-BUG-1786572: Medium severity php vulnerability
A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
Reference: https://bugs.php.net/bug.php?id=78863
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1786572?
The severity of REDHAT-BUG-1786572 is considered high due to potential security vulnerabilities that could arise from improper path handling in affected PHP versions.
How do I fix REDHAT-BUG-1786572?
To fix REDHAT-BUG-1786572, update PHP to version 7.2.26, 7.3.13, or later.
Which PHP versions are affected by REDHAT-BUG-1786572?
PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 are affected by REDHAT-BUG-1786572.
What is the impact of REDHAT-BUG-1786572 on applications?
The impact of REDHAT-BUG-1786572 could lead to security vulnerabilities in applications that handle filenames with embedded \0 bytes.
Is there a workaround for REDHAT-BUG-1786572?
There are no well-documented workarounds for REDHAT-BUG-1786572; updating to a secure version is the recommended solution.