CVE-2019-11048
Medium
Description
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Php
PublishedMay 20, 2020
First seenMay 20, 2020
How to fix
Update
- php php7.2.31, 7.3.18, 7.4.6 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBA3TFZSP3TB5N4G24SO6BI64RJZXE3D/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMDUQ7XFONY3BWTAQQUD3QUGZT6NFZUF/
- usn.ubuntu.com/4375-1/
- debian.org/security/2020/dsa-4717
- debian.org/security/2020/dsa-4719
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| php php | 7.2.0 ≤ v < 7.2.31, 7.3.0 ≤ v < 7.3.18, 7.4.0 ≤ v < 7.4.6 | 7.2.31, 7.3.18, 7.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.