Resource exhaustion in PHP - CVE-2019-11048

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU28318

Resource exhaustion in PHP - CVE-2019-11048

Published: May 28, 2020


Vulnerability identifier: #VU28318
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11048
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the way PHP handles long filenames or field names during file upload. A remote attacker can supply an overly long filename to the application that will lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This will lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.


Affected software

PHP
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Opensuse
openEuler
Fedora
Red Hat Software Collections
Tenable.sc
php7.0 (Debian package)
php7.0 (Ubuntu package)
php7 (Alpine package)
php7.2 (Ubuntu package)
php7.3 (Ubuntu package)
php7.4 (Ubuntu package)
php-opcache
php-fpm
php-gd
php-gmp
php-help
php-intl
php-json
php-ldap
php-mbstring
php-mysqlnd
php-odbc
php-embedded
php-pdo
php-pgsql
php-process
php-recode
php-snmp
php-soap
php-cli
php-xmlrpc
php-xml
php-tidy
php
php-bcmath
php-enchant
php-common
php-dba
php-dbg
php-debuginfo
php-debugsource
php-devel
php7.3 (Debian package)
rh-php73-php (Red Hat package)
Oracle Communications Diameter Signaling Router (DSR)

How to mitigate CVE-2019-11048

Install updates from vendor's website.

PHP - addressed in versions 7.2.31, 7.3.18, 7.4.6
Tenable.sc - update to 5.19.0
php7.0 (Debian package) - update to 7.0.33-0+deb9u8
php7.0 (Ubuntu package) - update to 7.0.33-0ubuntu0.16.04.15
php7 (Alpine package) - update to 7.2.31-r0
php7.2 (Ubuntu package) - update to 7.2.24-0ubuntu0.18.04.6
php7.3 (Ubuntu package) - update to 7.3.11-0ubuntu0.19.10.6
php7.4 (Ubuntu package) - update to 7.4.3-4ubuntu2.2
php-opcache - update to 7.2.10-6
php-fpm - update to 7.2.10-6
php-gd - update to 7.2.10-6
php-gmp - update to 7.2.10-6
php-help - update to 7.2.10-6
php-intl - update to 7.2.10-6
php-json - update to 7.2.10-6
php-ldap - update to 7.2.10-6
php-mbstring - update to 7.2.10-6
php-mysqlnd - update to 7.2.10-6
php-odbc - update to 7.2.10-6
php-embedded - update to 7.2.10-6
php-pdo - update to 7.2.10-6
php-pgsql - update to 7.2.10-6
php-process - update to 7.2.10-6
php-recode - update to 7.2.10-6
php-snmp - update to 7.2.10-6
php-soap - update to 7.2.10-6
php-cli - update to 7.2.10-6
php-xmlrpc - update to 7.2.10-6
php-xml - update to 7.2.10-6
php-tidy - update to 7.2.10-6
php - update to 7.2.10-6
php-bcmath - update to 7.2.10-6
php-enchant - update to 7.2.10-6
php-common - update to 7.2.10-6
php-dba - update to 7.2.10-6
php-dbg - update to 7.2.10-6
php-debuginfo - update to 7.2.10-6
php-debugsource - update to 7.2.10-6
php-devel - update to 7.2.10-6
php - addressed in versions 7.3.18-1.fc30, 7.3.18-1.fc31, 7.4.6-1.fc32
php7.3 (Debian package) - update to 7.3.19-1~deb10u1
rh-php73-php (Red Hat package) - update to 7.3.20-1.el7

External References

Related Security Bulletins