Allocation of Resources Without Limits or Throttling Affecting php:7.4/php-opcache package, versions <0:7.4.33-2.module_el8.10.0+3935+28808425


Severity

Recommended
medium

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.22% (62nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-ALMALINUX8-PHP-8533372
  • published19 Dec 2024
  • disclosed11 Dec 2024

Introduced: 11 Dec 2024

NewCVE-2023-0568  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:8 php:7.4/php-opcache to version 0:7.4.33-2.module_el8.10.0+3935+28808425 or higher.
This issue was patched in ALSA-2024:10952.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php:7.4/php-opcache package and not the php:7.4/php-opcache package as distributed by AlmaLinux. See How to fix? for AlmaLinux:8 relevant fixed versions and status.

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

CVSS Scores

version 3.1