USN-9055-1: php-pecl-http vulnerability
It was discovered that peclhttp incorrectly handled certain HTTP request parameters, leading to a type confusion. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/php-pecl-httpto a version that resolves this vulnerability.Fixed in 3.0.1-0ubuntu5+esm1
Event History
Frequently Asked Questions
What could an unauthenticated remote attacker achieve?
A remote attacker could send specially crafted HTTP request parameters to trigger type confusion, potentially causing PHP to crash and create a denial of service. The issue could also potentially allow arbitrary code execution.
What input path needs to be reachable for exploitation?
The affected PHP environment must process HTTP request parameters supplied by a remote attacker. The advisory does not provide further configuration, exposure, or mitigation details.