REDHAT-BUG-2317051: Medium severity The PHP Group PHP vulnerability
According to https://www.php.net/manual/en/security.cgi-bin.force-redirect.php, the configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL like http://host.example/cgi-bin/php/secretdir/script.php. The default value of cgi.forceredirect is 1.
But there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the PHP configuration directive cgi.force_redirect is set to its default value of 1 to prevent direct PHP access via URLs like /cgi-bin/php/.../script.php.
PHP cgi.force_redirect = 1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2317051?
The severity of REDHAT-BUG-2317051 is considered to be high due to the potential for unauthorized access to PHP scripts.
How do I fix REDHAT-BUG-2317051?
To fix REDHAT-BUG-2317051, ensure that the cgi.force_redirect directive is properly configured in your PHP settings.
What software is affected by REDHAT-BUG-2317051?
The vulnerability REDHAT-BUG-2317051 affects the PHP software from The PHP Group.
What are the potential risks of REDHAT-BUG-2317051?
The potential risks of REDHAT-BUG-2317051 include the possibility of script execution and unauthorized access to sensitive data.
Is there a patch available for REDHAT-BUG-2317051?
Yes, a patch or security update is typically provided by Red Hat for REDHAT-BUG-2317051.