遠端 Redhat Enterprise Linux 9 主機上安裝的套件受到 RHSA-2024: 0387 公告中提及的多個弱點影響。

  - 在 PHP 8.0.X 的 8.0.28 之前版本、8.1.X 的 8.1.16 之前版本和 8.2.X 的 8.2.3之前版本中，password_verify() 函式可能會將某些無效的 Blowfish 雜湊作爲有效雜湊來接受。如果這種無效的雜湊最終出現在密碼資料庫中，可能會導致應用程式允許此項目的任何密碼有效。(CVE-2023-0567)

  - 在 PHP 8.0.28 之前的 8.0.X 版、 8.1.16 之前的 8.1.X 版和 8.2.3 之前的 8.2.X 版中，核心路徑解析函式配置的緩衝區一個位元組太小。解析長度接近系統 MAXPATHLEN 設定的路徑時，這可能會導致已配置緩衝區之後的位元組被 NULL 值覆寫，進而可能導致未經授權的資料存取或修改。(CVE-2023-0568)

  - 在 PHP 8.0.28 之前的 8.0.X 版、 8.1.16 之前的 8.1.X 版和 8.2.3 之前的 8.2.X 版中，HTTP 表單上傳中的過量片段會造成高資源消耗和過量的記錄項目。這會耗盡 CPU 資源或磁碟空間，進而在受影響的伺服器上造成拒絕服務。(CVE-2023-0662)

  - 在 PHP 8.0.* 的 8.0.29 之前版本、8.1.* 的 8.1.20 之前版本、8.2.* 的 8.2.7 之前版本中，當使用 SOAP HTTP 摘要式驗證時，程式不會檢查隨機值產生器是否失敗，而且會使用較原本更窄的值範圍。如果隨機產生器失敗，可導致從用戶端向伺服器洩漏 31 位元的未初始化記憶體，而且這也會讓惡意伺服器更容易猜測用戶端的臨時值。(CVE-2023-3247)

  - 在 8.0.30 之前的 8.0.*、8.1.22 之前的 8.1.* 和 8.2.8 之前的 8.2.* 版 PHP 中，多種 XML 函式依賴 libxml 全域狀態來追蹤組態變數，例如外部實體是否已載入。
    系統會假設此狀態未變更，除非使用者透過呼叫適當的函式明確進行變更。不過，由於狀態為全域處理程序，因此其他模組 (例如 ImageMagick) 也可能在相同處理程序中使用此程式庫，並出於內部目的變更該全域狀態，並讓其保持在外部實體載入已啟用的狀態。這可能會導致剖析外部 XML 時載入外部實體，進而造成洩漏 PHP 可存取的任何本機檔案。此弱點狀態可能會持續存在於多個要求的相同處理程序中，直到處理程序關閉為止。(CVE-2023-3823)

  - 在 8.0.30 之前的 8.0.*、8.1.22 之前的 8.1.* 和 8.2.8 之前的 8.2.* 版 PHP 中，當載入 phar 檔案同時讀取 PHAR 目錄項目的時候，長度檢查不足可能會導致堆疊緩衝區溢位，進而造成記憶體損毀或 RCE。(CVE-2023-3824)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 9 主機中安裝的套件受到 ELSA-2024-0387 公告中提及的多個弱點影響。

  - 在 PHP 8.0.28 之前的 8.0.X 版、 8.1.16 之前的 8.1.X 版和 8.2.3 之前的 8.2.X 版中，核心路徑解析函式配置的緩衝區一個位元組太小。解析長度接近系統 MAXPATHLEN 設定的路徑時，這可能會導致已配置緩衝區之後的位元組被 NULL 值覆寫，進而可能導致未經授權的資料存取或修改。(CVE-2023-0568)

  - 在 PHP 8.0.X 的 8.0.28 之前版本、8.1.X 的 8.1.16 之前版本和 8.2.X 的 8.2.3之前版本中，password_verify() 函式可能會將某些無效的 Blowfish 雜湊作爲有效雜湊來接受。如果這種無效的雜湊最終出現在密碼資料庫中，可能會導致應用程式允許此項目的任何密碼有效。(CVE-2023-0567)

  - 在 8.0.30 之前的 8.0.*、8.1.22 之前的 8.1.* 和 8.2.8 之前的 8.2.* 版 PHP 中，當載入 phar 檔案同時讀取 PHAR 目錄項目的時候，長度檢查不足可能會導致堆疊緩衝區溢位，進而造成記憶體損毀或 RCE。(CVE-2023-3824)

  - 在 8.0.30 之前的 8.0.*、8.1.22 之前的 8.1.* 和 8.2.8 之前的 8.2.* 版 PHP 中，多種 XML 函式依賴 libxml 全域狀態來追蹤組態變數，例如外部實體是否已載入。
    系統會假設此狀態未變更，除非使用者透過呼叫適當的函式明確進行變更。不過，由於狀態為全域處理程序，因此其他模組 (例如 ImageMagick) 也可能在相同處理程序中使用此程式庫，並出於內部目的變更該全域狀態，並讓其保持在外部實體載入已啟用的狀態。這可能會導致剖析外部 XML 時載入外部實體，進而造成洩漏 PHP 可存取的任何本機檔案。此弱點狀態可能會持續存在於多個要求的相同處理程序中，直到處理程序關閉為止。(CVE-2023-3823)

  - 在 PHP 8.0.* 的 8.0.29 之前版本、8.1.* 的 8.1.20 之前版本、8.2.* 的 8.2.7 之前版本中，當使用 SOAP HTTP 摘要式驗證時，程式不會檢查隨機值產生器是否失敗，而且會使用較原本更窄的值範圍。如果隨機產生器失敗，可導致從用戶端向伺服器洩漏 31 位元的未初始化記憶體，而且這也會讓惡意伺服器更容易猜測用戶端的臨時值。(CVE-2023-3247)

  - 在 PHP 8.0.28 之前的 8.0.X 版、 8.1.16 之前的 8.1.X 版和 8.2.3 之前的 8.2.X 版中，HTTP 表單上傳中的過量片段會造成高資源消耗和過量的記錄項目。這會耗盡 CPU 資源或磁碟空間，進而在受影響的伺服器上造成拒絕服務。(CVE-2023-0662)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0568 advisory.

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this May lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0514-1 advisory.

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may     accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database,     it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0513-1 advisory.

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may     accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database,     it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5363 advisory.

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

  - php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

  - Password_verify() always return true with some hash [fedora-36] (CVE-2023-0567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-139 advisory.

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may     accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database,     it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567)

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of php installed on the remote host is prior to 8.2.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.2-2023-001 advisory.

    2023-09-14: CVE-2023-0568 was added to this advisory.

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may     accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database,     it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567)

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

    In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may     accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database,     it may lead to an application allowing any password for this entry as valid. (CVE-2023-0567)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function     allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting,     this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to     unauthorized data access or modification. (CVE-2023-0568)

  - In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP     form upload can cause high resource consumption and excessive number of log entries. This can cause denial     of service on the affected server by exhausting CPU resources or disk space. (CVE-2023-0662)

  - When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the     X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2,     10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This     could result in the user agent transmitting the session cookie over an insecure channel. (CVE-2023-28708)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:10952 advisory.

    * php: 1-byte array overrun in common path resolve code (CVE-2023-0568)
      * php: Password_verify() always return true with some hash (CVE-2023-0567)
      * php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP     (CVE-2023-3247)
      * php: XML loading external entity without being enabled (CVE-2023-3823)
      * php: phar Buffer mismanagement (CVE-2023-3824)
      * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
      * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
      * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
      * php: Erroneous parsing of multipart form data (CVE-2024-8925)
      * php: cgi.force_redirect configuration is bypassable due to the environment variable collision     (CVE-2024-8927)
      * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5926 advisory.

    [8.0.30-1]
    - rebase to 8.0.30
    - Resolves: RHEL-11946

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0387 advisory.

    * php: 1-byte array overrun in common path resolve code (CVE-2023-0568)
    * php: DoS vulnerability when parsing multipart request body (CVE-2023-0662)
    * php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP     (CVE-2023-3247)
    * php: XML loading external entity without being enabled (CVE-2023-3823)
    * php: phar Buffer mismanagement (CVE-2023-3824)
    * php: Password_verify() always return true with some hash (CVE-2023-0567)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202408-32 (PHP: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
189487	RHEL 9：php：8.1 (RHSA-2024: 0387)	Nessus	Red Hat Local Security Checks	2024/1/24	2025/4/29	critical
189591	Oracle Linux 9：php：8.1 (ELSA-2024-0387)	Nessus	Oracle Linux Local Security Checks	2024/1/25	2025/9/9	critical
172933	CBL Mariner 2.0 Security Update: php (CVE-2023-0568)	Nessus	MarinerOS Local Security Checks	2023/3/20	2025/2/10	high
171906	SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2023:0514-1)	Nessus	SuSE Local Security Checks	2023/2/25	2023/7/14	high
171913	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2023:0513-1)	Nessus	SuSE Local Security Checks	2023/2/25	2023/7/14	high
171921	Debian DSA-5363-1 : php7.4 - security update	Nessus	Debian Local Security Checks	2023/2/26	2023/9/1	high
173338	Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-139)	Nessus	Amazon Linux Local Security Checks	2023/3/23	2024/12/11	high
181378	Amazon Linux 2 : php (ALASPHP8.2-2023-001)	Nessus	Amazon Linux Local Security Checks	2023/9/13	2024/12/11	high
177004	EulerOS 2.0 SP8 : php (EulerOS-SA-2023-2196)	Nessus	Huawei Local Security Checks	2023/6/9	2024/6/7	high
213249	AlmaLinux 8 : php:7.4 (ALSA-2024:10952)	Nessus	Alma Linux Local Security Checks	2024/12/19	2025/3/20	critical
183739	Oracle Linux 9 : php (ELSA-2023-5926)	Nessus	Oracle Linux Local Security Checks	2023/10/23	2025/9/9	critical
189623	AlmaLinux 9 : php:8.1 (ALSA-2024:0387)	Nessus	Alma Linux Local Security Checks	2024/1/26	2025/1/13	critical
205520	GLSA-202408-32 : PHP: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/8/14	2025/11/3	critical

检测

插件搜索

critical

critical

high

high

high

high

high

high

high

critical

critical

critical

critical