Vulnerability · Published Oct 8, 2024 · Assigned by php

CVE-2024-9026PHP-FPM logs from children may be altered

Low 3.3

In plain English

A low-severity security flaw in PHP from PHP Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.5%top 57.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9apcu-panel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2024:10951
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2024:10951
AlmaLinux:8libzip1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2024:10951
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2024:10951
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-bcmath8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-bcmath7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-bcmath8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-bcmath8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-cli8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-cli7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-cli8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-cli8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-common7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-common8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-common8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-common8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-dba7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-dba8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-dba8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-dba8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-dbg7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-dbg8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-dbg8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-dbg8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-devel7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-devel8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-devel8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-devel8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-embedded7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-embedded8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-embedded8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-embedded8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-enchant8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-enchant7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-enchant8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-enchant8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-ffi8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-ffi7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-ffi8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-ffi8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-fpm7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-fpm8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-fpm8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-fpm8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-gd8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-gd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gd8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-gd8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-gmp8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-gmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gmp8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-gmp8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-intl7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-intl8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-intl8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-intl8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-json7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-ldap8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-ldap8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-mbstring8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-mbstring7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-mbstring8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-mbstring8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-mysqlnd8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-mysqlnd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-mysqlnd8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-mysqlnd8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-odbc8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-odbc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-odbc8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-odbc8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-opcache8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-opcache7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-opcache8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-opcache8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-pdo7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pdo8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-pdo8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-pdo8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pear1:1.10.14-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-apcu5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9php-pecl-apcu5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu-devel5.1.23-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu-devel5.1.23-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.3.0+2009+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.4.0+2229+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3059+d65eee13ALSA-2024:10952
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2024:10950
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:10949
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug33.2.2-2.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:9php-pecl-xdebug33.2.2-2.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.22.3-1.module_el8.10.0+3796+30ed3ef7ALSA-2024:10951
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2024:10950
AlmaLinux:9php-pecl-zip1.22.3-1.module_el9.4.0+65+49ff6472ALSA-2024:10949
AlmaLinux:8php-pgsql7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pgsql8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-pgsql8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-pgsql8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-process8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:8php-process7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-process8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-process8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-snmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-snmp8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-snmp8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:9php-snmp8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:8php-soap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-soap8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-soap8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-soap8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-xml7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-xml8.2.25-1.module_el8.10.0+3936+14b35499ALSA-2024:10951
AlmaLinux:9php-xml8.1.30-1.module_el9.5.0+131+62ecd687ALSA-2024:10950
AlmaLinux:9php-xml8.2.25-1.module_el9.5.0+132+adb0ae7aALSA-2024:10949
AlmaLinux:8php-xmlrpc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
Alpine:v3.20php828.2.24-r0ALPINE-CVE-2024-9026
Alpine:v3.20php838.3.12-r0ALPINE-CVE-2024-9026
Debian:12php8.28.2.24-1~deb12u1DSA-5780-1
Debian:12php8.28.2.24-1~deb12u1DEBIAN-CVE-2024-9026
Rocky Linux:8libzip0:1.7.3-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php0:7.4.33-2.module+el8.10.0+1912+72767185RLSA-2024:10952
Rocky Linux:8php0:8.2.25-1.module+el8.10.0+1911+f499711eRLSA-2024:10951
Rocky Linux:8php-pear1:1.10.14-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-apcu0:5.1.23-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:9php-pecl-apcu0:5.1.23-1.module+el9.6.0+32042+808943aeRLSA-2024:10949
Rocky Linux:9php-pecl-apcu0:5.1.21-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Rocky Linux:9php-pecl-apcu0:5.1.23-1.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-rrd0:2.0.3-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:10949
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:10949
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:10950
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:10950
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-xdebug30:3.2.2-2.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:9php-pecl-xdebug30:3.1.4-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Rocky Linux:9php-pecl-xdebug30:3.2.2-2.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-zip0:1.22.3-1.module+el8.10.0+1596+477f03f8RLSA-2024:10951
Rocky Linux:9php-pecl-zip0:1.22.3-1.module+el9.6.0+32042+808943aeRLSA-2024:10949
Rocky Linux:9php-pecl-zip0:1.22.3-1.module+el9.6.0+32041+66e66fb7RLSA-2024:10949
Rocky Linux:9php-pecl-zip0:1.20.1-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:10950
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.19UBUNTU-CVE-2024-9026
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.19USN-7049-1
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.2USN-7049-1
Ubuntu:24.04:LTSphp8.38.3.6-0ubuntu0.24.04.2UBUNTU-CVE-2024-9026

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.1.* – before 8.1.308.2.* – before 8.2.248.3.* – before 8.3.12

Weakness: CWE-158, CWE-117 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References