CVE-2019-11048 Temporary files are not cleaned after OOM when parsing HTTP request data
Attackers can exhaust disk space by triggering uncleaned temporary files during memory limit hits in PHP file uploads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11048?
CVE-2019-11048 is a medium-severity denial of service vulnerability in Php Php, published on 20 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
Which versions are affected by CVE-2019-11048?
It affects 1 product.
Linux distribution packages (7)
php7 SUSE:Linux Enterprise Module for Package Hub 15 SP1 | All versions | 7.2.5-4.58.2 |
php7 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 7.0.7-50.94.1 |
php7 SUSE:Linux Enterprise Module for Web and Scripting 15 SP1 | All versions | 7.2.5-4.58.2 |
php7 SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 7.0.7-50.94.1 |
php7 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 7.0.7-50.94.1 |
php7 openSUSE:Leap 15.1 | All versions | 7.2.5-lp151.6.28.1 |
php7-test openSUSE:Leap 15.1 | All versions | 7.2.5-lp151.6.28.1 |
Products include Php Php.
How do I fix CVE-2019-11048?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-11048 being exploited?
There is no known exploitation of CVE-2019-11048 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as DEBIAN-CVE-2019-11048, DLA-2261-1, GHSA-wxwf-j52f-79g8, MGASA-2020-0236, SUSE-SU-2020:1545-1, SUSE-SU-2020:1661-1 and 4 more.