erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: June 6, 2024

1 editorial brief and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows. Operators of Windows servers running PHP through php-cgi.exe (Apache CGI mode, XAMPP's default /php-cgi/ alias, or php binaries in a web-reachable CGI directory), especially on Chinese or Japanese system locales.
  • PyPI: 2 critical advisories (lightning, mlflow). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2024-4577

CVE-2024-4577: PHP-CGI Argument Injection RCE on Windows

If you run PHP on Windows behind Apache in CGI mode (including any default XAMPP install), treat it as compromised-until-proven-otherwise and patch or remove CGI today; everyone else can relax.

Must act: Operators of Windows servers running PHP through php-cgi.exe (Apache CGI mode, XAMPP's default /php-cgi/ alias, or php binaries in a web-reachable CGI directory), especially on Chinese or Japanese system locales.

Can relax: Linux and macOS PHP hosts, and Windows hosts using mod_php, FastCGI or PHP-FPM rather than PHP-CGI, are not affected by this bug.

  1. Inventory Windows hosts running PHP and check `php -v` and whether php-cgi.exe is reachable over HTTP
  2. Upgrade to a supported PHP branch (8.2 or later) at or above the fixed releases
  3. On XAMPP, comment out the `ScriptAlias /php-cgi/` line in httpd-xampp.conf if you do not need PHP-CGI

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 2

Check: pip-audit (or: pip show <package>)