Input validation error in php7 (Alpine package)
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-11045 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
php7 (Alpine package) Operating systems & Components / Operating system package or component |
| Vendor | Alpine Linux Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
1) Input validation error
EUVDB-ID: #VU33363
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-11045
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.
MitigationInstall update from vendor's website.
Vulnerable software versionsphp7 (Alpine package): 7.2.24-r0
External linkshttp://git.alpinelinux.org/aports/commit/?id=5ea4a0536e0f920f0bffd2ac54ce75665830e4ab
http://git.alpinelinux.org/aports/commit/?id=c34558aad0fa77a9c307564822690940e618b972
http://git.alpinelinux.org/aports/commit/?id=2e744b63543aae404c54b88ee4b4135a58449190
http://git.alpinelinux.org/aports/commit/?id=840f665bfeaa4de03d66d8a6d69ceb3a331e3bf6
http://git.alpinelinux.org/aports/commit/?id=89bf7fcf675ffb9138a3afe613cb1f7c918b57ac
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
