Bug 1786572 (CVE-2019-11045)

Summary:	CVE-2019-11045 php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, hhorak, jorton, rcollet, webstack-team, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-08 13:18:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1786573, 1789129, 1789130, 1789131, 1789132, 1789133, 1857704
Bug Blocks:	1786580

Description Dhananjay Arunesh 2019-12-26 09:55:45 UTC

A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference:
https://bugs.php.net/bug.php?id=78863

Comment 1 Dhananjay Arunesh 2019-12-26 09:56:11 UTC

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1786573]

Comment 2 Marco Benatto 2020-01-08 19:50:08 UTC

Upstream patch for this issue:
http://git.php.net/?p=php-src.git;a=commit;h=a5a15965da23c8e97657278fc8dfbf1dfb20c016

Comment 5 Marco Benatto 2020-01-08 20:40:26 UTC

There's an issue with SPL PHP extension on spl_filesystem_object_construct() function. When creating a new DirectoryIterator() object spl_filesystem_object_construct() function is called and use zend to parse its arguments with the wrong parameter type specifier, this bug leads the zend_parse_parameters() to interprete the parameter as a simple string instead of a filesystem path. An attacker may leverage this by crafting a path name containing NULL bytes which will be badly parsed, allowing the attacker eventually by pass any path-based security validation or listing documents from a unexpected directory.

This flaw has a high Confidentiality impact as the actor may eventually seen the filesystem tree from the attacked machine but a high complexity as the attacker may need to have previous knowledge of filesystem organization or trick the user to run the malicious script.

Comment 8 Vijay Yadav 2020-02-24 18:04:43 UTC

Any ETA for this fix.

Comment 10 errata-xmlrpc 2020-09-08 09:46:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3662 https://access.redhat.com/errata/RHSA-2020:3662

Comment 11 Product Security DevOps Team 2020-09-08 13:18:36 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11045

Comment 12 errata-xmlrpc 2020-12-01 12:02:51 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2020:5275 https://access.redhat.com/errata/RHSA-2020:5275