OS Command Injection Affecting php8.2 package, versions <8.2.24-1~deb12u1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN12-PHP82-8097747
- published 26 Sep 2024
- disclosed 8 Oct 2024
Introduced: 26 Sep 2024
CVE-2024-8926 Open this link in a new tabHow to fix?
Upgrade Debian:12 php8.2 to version 8.2.24-1~deb12u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream php8.2 package and not the php8.2 package as distributed by Debian.
See How to fix? for Debian:12 relevant fixed versions and status.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.