Vulnerability Description
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.2.0, < 7.2.31 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00045.html
- https://bugs.php.net/bug.php?id=78875ExploitIssue TrackingVendor Advisory
- https://bugs.php.net/bug.php?id=78876ExploitIssue TrackingVendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/06/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20200528-0006/
- https://usn.ubuntu.com/4375-1/
- https://www.debian.org/security/2020/dsa-4717
- https://www.debian.org/security/2020/dsa-4719
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.tenable.com/security/tns-2021-14
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00045.html
- https://bugs.php.net/bug.php?id=78875ExploitIssue TrackingVendor Advisory
FAQ
What is CVE-2019-11048?
CVE-2019-11048 is a vulnerability with a CVSS score of 5.3 (MEDIUM). In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocat...
How severe is CVE-2019-11048?
CVE-2019-11048 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11048?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php.