Bug 1348927 (CVE-2015-8935)

Summary:	CVE-2015-8935 php: HTTP response splitting in header() function
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, dmcphers, fedora, hhorak, jialiu, jokerman, jorton, lmeyer, mmccomas, rcollet, sardella, tiwillia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	php 5.4.38, php 5.5.22, php 5.6.6	Doc Type:	If docs needed, set a value
Doc Text:	The header() PHP function allowed header stings containing line break followed by a space or tab, as allowed by RFC 2616. Certain browsers handled the continuation line as new header, making it possible to conduct a HTTP response splitting attack against such browsers. The header() function was updated to follow RFC 7230 and not allow any line breaks.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 00:53:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1348930

Description Andrej Nemec 2016-06-22 10:42:31 UTC

A vulnerability was found in php. The filtering in header() function is not sufficient and this can lead to header injection and content injection (XSS) when the client is Internet Explorer (in every tested version).

Upstream bug:

https://bugs.php.net/bug.php?id=68978

Upstream fix:

https://github.com/php/php-src/commit/996faf964bba1aec06b153b370a7f20d3dd2bb8b

References:

http://seclists.org/oss-sec/2016/q2/570

Comment 1 Tomas Hoger 2016-06-28 13:18:56 UTC

The header() PHP function implements a protection against HTTP response splitting attacks - it does not sent a header if it contains a line break.  There was an exception to this check - line breaks were allowed if followed by space or tab character.  Such behaviour was consistent with RFC 2616 (Hypertext Transfer Protocol -- HTTP/1.1).  Browsers usually treat the second line as a continuation of the previous header line.  According to the information in the upstream PHP bug report, certain browsers, including Internet Explorer, may treat the second line as a new header.

Upstream fix for this issue removes the exception which is no longer allowed by RFC 7230 (Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing), which obsoletes RFC 2616.  The patch was applied in upstream versions 5.4.38, 5.5.22, and 5.6.6.

Note that this change may introduce a regression where code generates headers with trusted content that use continuation syntax.

Comment 2 Tomas Hoger 2016-06-28 13:22:32 UTC

The PHP packages as shipped in php54 collection in Red Hat Software Collections was previously updated to upstream version 5.4.40 via RHSA-2015:1066 and hence already include the fix for this issue.

https://rhn.redhat.com/errata/RHSA-2015-1066.html