Tim Düsterhus

PHP contains an issue where credentials could be leaked during a redirect when using curl. This occurs when the application follows a redirect to an external host and inadvertently includes authentication credentials in the request to the new location.

The `metaphone()` function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. When a string exceeding 2,147,483,647 bytes is processed, a signed integer overflow occurs. This leads to undefined behavior, specifically an out-of-bounds read, which can cause a segmentation fault or access to unrelated memory, potentially impacting the availability of the PHP process.

The issue is related to the incorrect parsing of folded headers in HTTP responses by the http request module in PHP. This may lead to misinterpreting the response and using incorrect headers, MIME types, etc. The vulnerability can be exploited by a remote attacker to send hidden HTTP requests.

The issue is related to the use of the wrong content-type header to determine the charset when a requested resource performs a redirect, potentially causing the resulting document to be parsed incorrectly or bypass validations. This can occur when requesting an HTTP resource using the DOM or SimpleXML extensions in PHP. The vulnerability may allow a remote attacker to redirect a user to an arbitrary URL.

The issue is related to the use of a random value generator with a narrower range of values than it should have when using SOAP HTTP Digest Authentication. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.

The issue is related to the password verification function in PHP, which may accept some invalid Blowfish hashes as valid. If such an invalid hash ends up in the password database, it may lead to an application allowing any password for this entry as valid. This is due to insufficient computation of the password hash. The `password verify()` function is specifically affected.

The issue is related to a mismatch between Host and authority being mishandled, which can lead to an attacker-controlled HTTP Host header. This can allow a remote attacker to impact data integrity.

The issue is related to insufficient input validation in the HAProxy HTTP server software. This allows a remote attacker to impact data integrity. Specifically, an HTTP method name may contain a space followed by the name of a protected resource, which could be interpreted by the server as a request for that protected resource. For example, a request like "GET /admin? HTTP/1.1 /static/images HTTP/1.1" could be misinterpreted.

An issue was discovered in HAProxy where it does not ensure that the scheme and path portions of a URI have the expected characters. For example, the authority field might differ from what the routing rules were intended to achieve, potentially allowing a remote attacker to access confidential data due to insufficient input validation.

The issue is related to the HTTP/2 implementation in HAProxy, which mishandles headers. This can be exploited by an attacker to gain access to confidential data, disrupt data integrity, and cause a denial of service. The vulnerability is demonstrated by the improper handling of carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0).

Name of the Vulnerable Software and Affected Versions: HAProxy versions 1.8.x through 1.9.0 Description: An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder, which can result in a crash. The issue arises from the processing of the PRIORITY flag in a HEADERS frame, where 5 extra bytes are required but not properly checked, potentially leading to a denial of service. This can be exploited by a remote attacker using a specially crafted packet. Recommendations: For HAProxy versions 1.8.x through 1.9.0, consider disabling the HTTP/2 protocol decoder until a patch is available to prevent potential crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to an out-of-bounds read access in the HPACK decoder of HAProxy, which can be exploited by a remote attacker to cause a denial of service. This is due to a flaw in the `hpack valid idx()` function.