A vulnerability was found in php. The filtering in header() function is not sufficient and this can lead to header injection and content injection (XSS) when the client is Internet Explorer (in every tested version). Upstream bug: https://bugs.php.net/bug.php?id=68978 Upstream fix: https://github.com/php/php-src/commit/996faf964bba1aec06b153b370a7f20d3dd2bb8b References: http://seclists.org/oss-sec/2016/q2/570
The header() PHP function implements a protection against HTTP response splitting attacks - it does not sent a header if it contains a line break. There was an exception to this check - line breaks were allowed if followed by space or tab character. Such behaviour was consistent with RFC 2616 (Hypertext Transfer Protocol -- HTTP/1.1). Browsers usually treat the second line as a continuation of the previous header line. According to the information in the upstream PHP bug report, certain browsers, including Internet Explorer, may treat the second line as a new header. Upstream fix for this issue removes the exception which is no longer allowed by RFC 7230 (Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing), which obsoletes RFC 2616. The patch was applied in upstream versions 5.4.38, 5.5.22, and 5.6.6. Note that this change may introduce a regression where code generates headers with trusted content that use continuation syntax.
The PHP packages as shipped in php54 collection in Red Hat Software Collections was previously updated to upstream version 5.4.40 via RHSA-2015:1066 and hence already include the fix for this issue. https://rhn.redhat.com/errata/RHSA-2015-1066.html