Bug 1348927 – CVE-2015-8935 php: HTTP response splitting in header() function

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1348927 - (CVE-2015-8935) CVE-2015-8935 php: HTTP response splitting in header() function

Summary:	CVE-2015-8935 php: HTTP response splitting in header() function

Status:	NEW

Aliases:	CVE-2015-8935

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20150203,repor...
Keywords:	Security

Depends On:
Blocks:	1348930
	Show dependency tree / graph

Reported:	2016-06-22 06:42 EDT by Andrej Nemec
Modified:	2018-06-29 18:12 EDT (History)
CC List:	13 users (show)

See Also:
Fixed In Version:	php 5.4.38, php 5.5.22, php 5.6.6
Doc Type:	If docs needed, set a value
Doc Text:	The header() PHP function allowed header stings containing line break followed by a space or tab, as allowed by RFC 2616. Certain browsers handled the continuation line as new header, making it possible to conduct a HTTP response splitting attack against such browsers. The header() function was updated to follow RFC 7230 and not allow any line breaks.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2016-06-22 06:42:31 EDT

A vulnerability was found in php. The filtering in header() function is not sufficient and this can lead to header injection and content injection (XSS) when the client is Internet Explorer (in every tested version).

Upstream bug:

https://bugs.php.net/bug.php?id=68978

Upstream fix:

https://github.com/php/php-src/commit/996faf964bba1aec06b153b370a7f20d3dd2bb8b

References:

http://seclists.org/oss-sec/2016/q2/570

Comment 1 Tomas Hoger 2016-06-28 09:18:56 EDT

The header() PHP function implements a protection against HTTP response splitting attacks - it does not sent a header if it contains a line break.  There was an exception to this check - line breaks were allowed if followed by space or tab character.  Such behaviour was consistent with RFC 2616 (Hypertext Transfer Protocol -- HTTP/1.1).  Browsers usually treat the second line as a continuation of the previous header line.  According to the information in the upstream PHP bug report, certain browsers, including Internet Explorer, may treat the second line as a new header.

Upstream fix for this issue removes the exception which is no longer allowed by RFC 7230 (Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing), which obsoletes RFC 2616.  The patch was applied in upstream versions 5.4.38, 5.5.22, and 5.6.6.

Note that this change may introduce a regression where code generates headers with trusted content that use continuation syntax.

Comment 2 Tomas Hoger 2016-06-28 09:22:32 EDT

The PHP packages as shipped in php54 collection in Red Hat Software Collections was previously updated to upstream version 5.4.40 via RHSA-2015:1066 and hence already include the fix for this issue.

https://rhn.redhat.com/errata/RHSA-2015-1066.html

Note You need to log in before you can comment on or make changes to this bug.