Veracode Vulnerability DatabaseVERACODE:26199Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
PHP is vulnerable to denial of service (DoS). When using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
| CPE | Name | Operator | Version |
|---|---|---|---|
| php7 | eq | 7.2.27-r0 | |
| rh-php73-php | eq | 7.3.11__1.el7 | |
| php7 | eq | 7.2.27-r0 | |
| rh-php73-php | eq | 7.3.11__1.el7 |
References
lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html
bugs.php.net/bug.php?id=79221
lists.debian.org/debian-lts-announce/2020/03/msg00034.html
security.gentoo.org/glsa/202003-57
usn.ubuntu.com/4330-1/
www.debian.org/security/2020/dsa-4717
www.debian.org/security/2020/dsa-4719
www.tenable.com/security/tns-2021-14
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P