Tim Düsterhus

PHP contains an issue where credentials could be leaked during a redirect when using curl. This occurs when the application follows a redirect to an external host and inadvertently includes authentication credentials in the request to the new location.

تستخدم الدالة `metaphone()` الموجودة في ملف ext/standard/metaphone.c متغيرًا من نوع signed int لتتبع الموضع الحالي داخل سلسلة الإدخال. وعند معالجة سلسلة تتجاوز 2,147,483,647 بايت، يحدث تجاوز سعة المتغير من نوع signed int. ويؤدي ذلك إلى سلوك غير محدد، وتحديدًا قراءة خارج النطاق، مما قد يتسبب في حدوث خطأ في التجزئة أو الوصول إلى ذاكرة غير ذات صلة، مما قد يؤثر على توفر عملية PHP.

تتعلق المشكلة بالتحليل غير الصحيح للرؤوس المزدوجة في استجابات HTTP بواسطة وحدة طلبات HTTP في PHP. وقد يؤدي ذلك إلى تفسير غير صحيح للاستجابة واستخدام رؤوس وأنواع MIME غير صحيحة، وما إلى ذلك. يمكن لمهاجم عن بُعد استغلال هذه الثغرة لإرسال طلبات HTTP مخفية.

تتعلق المشكلة باستخدام رأس content-type غير صحيح لتحديد مجموعة الأحرف (charset) عندما يقوم المورد المطلوب بإجراء إعادة توجيه، مما قد يؤدي إلى تحليل غير صحيح للوثيقة الناتجة أو التحايل على عمليات التحقق من الصحة. قد يحدث هذا عند طلب مورد HTTP باستخدام ملحقات DOM أو SimpleXML في PHP. قد تسمح هذه الثغرة الأمنية لمهاجم عن بُعد بإعادة توجيه مستخدم إلى عنوان URL تعسفي.

The issue is related to the use of a random value generator with a narrower range of values than it should have when using SOAP HTTP Digest Authentication. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.

The issue is related to the password verification function in PHP, which may accept some invalid Blowfish hashes as valid. If such an invalid hash ends up in the password database, it may lead to an application allowing any password for this entry as valid. This is due to insufficient computation of the password hash. The `password verify()` function is specifically affected.

The issue is related to a mismatch between Host and authority being mishandled, which can lead to an attacker-controlled HTTP Host header. This can allow a remote attacker to impact data integrity.

The issue is related to insufficient input validation in the HAProxy HTTP server software. This allows a remote attacker to impact data integrity. Specifically, an HTTP method name may contain a space followed by the name of a protected resource, which could be interpreted by the server as a request for that protected resource. For example, a request like "GET /admin? HTTP/1.1 /static/images HTTP/1.1" could be misinterpreted.

An issue was discovered in HAProxy where it does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field might differ from what the routing rules were intended to achieve, potentially allowing a remote attacker to access confidential data due to insufficient input validation.

The issue is related to the HTTP/2 implementation in HAProxy, which mishandles headers. This can be exploited by an attacker to gain access to confidential data, disrupt data integrity, and cause a denial of service. The vulnerability is demonstrated by the improper handling of carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0).

Name of the Vulnerable Software and Affected Versions: HAProxy versions 1.8.x through 1.9.0 Description: An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder, which can result in a crash. The issue arises from the processing of the PRIORITY flag in a HEADERS frame, where 5 extra bytes are required but not properly checked, potentially leading to a denial of service. This can be exploited by a remote attacker using a specially crafted packet. Recommendations: For HAProxy versions 1.8.x through 1.9.0, consider disabling the HTTP/2 protocol decoder until a patch is available to prevent potential crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an out-of-bounds read access in the HPACK decoder of HAProxy, which can be exploited by a remote attacker to cause a denial of service. This is due to a flaw in the `hpack valid idx()` function.