Bug 2317049 (CVE-2024-8925)

Summary:	CVE-2024-8925 php: Erroneous parsing of multipart form data
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in PHP's parsing of multipart form data contents, which affects both file and input form data. This may lead to legitimate data not being processed, violating data integrity. For example, if a multipart form data payload contains a valid prefix 'X' of the defined boundary B such that 5Kib < \|X\| < \|B\| < 8Kib, the logic responsible for parsing and storing the multipart payload fails to correctly extract the contents between two boundaries.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-10-07 19:52:11 UTC

Erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed thus, violating data integrity.

Comment 1 errata-xmlrpc 2024-12-11 11:44:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:10952 https://access.redhat.com/errata/RHSA-2024:10952

Comment 2 errata-xmlrpc 2024-12-11 11:44:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:10950 https://access.redhat.com/errata/RHSA-2024:10950

Comment 3 errata-xmlrpc 2024-12-11 11:45:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:10949 https://access.redhat.com/errata/RHSA-2024:10949

Comment 4 errata-xmlrpc 2024-12-11 11:45:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:10951 https://access.redhat.com/errata/RHSA-2024:10951

Comment 5 errata-xmlrpc 2025-05-13 10:35:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:7315 https://access.redhat.com/errata/RHSA-2025:7315