Vulnerability in PHP-FPM Allow Remote Attackers to Manipulate Log Messages and Remove Up to 4 Characters

CVE-2024-9026

What is CVE-2024-9026?

A vulnerability has been identified in PHP versions 8.1.* prior to 8.1.30, 8.2.* prior to 8.2.24, and 8.3.* prior to 8.3.12, specifically when using the PHP-FPM (FastCGI Process Manager) with the catch_workers_output directive set to 'yes'. This issue allows for potential pollution of the final logs or the inadvertent removal of up to four characters from log messages due to manipulation of the content. When configured to utilize syslog output, this vulnerability could facilitate further loss of log data, impacting the integrity and reliability of logging systems utilized for monitoring and security purposes.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References