Vulnerability in PHP-FPM Allow Remote Attackers to Manipulate Log Messages and Remove Up to 4 Characters

CVE-2024-9026

Summary

A vulnerability has been identified in PHP versions 8.1.* prior to 8.1.30, 8.2.* prior to 8.2.24, and 8.3.* prior to 8.3.12, specifically when using the PHP-FPM (FastCGI Process Manager) with the catch_workers_output directive set to 'yes'. This issue allows for potential pollution of the final logs or the inadvertent removal of up to four characters from log messages due to manipulation of the content. When configured to utilize syslog output, this vulnerability could facilitate further loss of log data, impacting the integrity and reliability of logging systems utilized for monitoring and security purposes.

References