CVE-2024-8929
NoneCVSS
—
EPSS
2.2%
Published
Nov 22, 2024
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
A flaw in PHP could allow a malicious database server to steal private information that belongs to your applications or users.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- Library
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
A hostile MySQL server can trigger the PHP client to return heap memory contents containing data from prior SQL queries or other process memory belonging to different users.
Why it matters to the business
Organizations running affected PHP versions risk unintended disclosure of sensitive database query data or user information to an attacker-controlled MySQL server, increasing breach exposure and compliance risk; low EPSS and absence from KEV indicate limited observed exploitation but still requires prompt patching given widespread PHP usage.
How an attack unfolds
An attacker configures or compromises a MySQL server, then causes a vulnerable PHP application to connect to it via manipulated connection strings or DNS; the server responds with crafted packets that force the client to leak heap contents back to the attacker.
How to fix it
Upgrade PHP to 8.1.31 or later, 8.2.26 or later, or 8.3.14 or later. Apply the listed fixed versions for graphicsmagick (1.3.18-1ubuntu3.1 or 1.3.23-1ubuntu0.1) and imagemagick (8:6.7.7.10-6ubuntu3.1 or 8:6.8.9.9-7ubuntu5.1) on affected Ubuntu releases; verify the php/php-src commit 38123aca18c3c1bd1f109ec77af2f175d7afcf35 is incorporated.
How to confirm the fix worked
Confirm PHP version is at or above the fixed releases; perform controlled connection tests against a non-malicious server and inspect for absence of unexpected memory disclosure in responses.
Typical attack path
- Position a malicious MySQL server reachable by the target PHP application
- Alter connection parameters or resolution to redirect the client to the attacker server
- Trigger a database connection from the vulnerable PHP MySQL client
- Receive and parse leaked heap data embedded in server responses
How to detect it
Search application and database logs for connections to unexpected or external MySQL servers; review network traffic for anomalous responses during PHP MySQL client sessions and correlate with heap-like data patterns in captured packets.
What your security team should do
- Prioritize upgrading all PHP 8.1/8.2/8.3 installations to the fixed releases within the next maintenance window
- Review and harden MySQL connection strings and DNS configurations to prevent redirection to untrusted servers
- Add monitoring for unexpected external MySQL endpoints in application logs
The record
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:8 | apcu-panel | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip-devel | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | libzip-tools | 0 | 1.7.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-bcmath | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-cli | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-common | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-dba | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-dbg | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-devel | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-embedded | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-enchant | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-ffi | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-fpm | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-gd | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-gmp | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-intl | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-ldap | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-mbstring | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-mysqlnd | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-odbc | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-opcache | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-pdo | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-pear | 0 | 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-apcu | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-apcu-devel | 0 | 5.1.23-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-rrd | 0 | 2.0.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-xdebug3 | 0 | 3.2.2-2.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pecl-zip | 0 | 1.22.3-1.module_el8.10.0+3796+30ed3ef7 |
| AlmaLinux:8 | php-pgsql | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-process | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-snmp | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-soap | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:8 | php-xml | 0 | 8.2.28-1.module_el8.10.0+4046+958a243a |
| AlmaLinux:9 | apcu-panel | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | apcu-panel | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-bcmath | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-bcmath | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-cli | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-cli | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-common | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-common | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-dba | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-dba | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-dbg | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-dbg | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-devel | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-devel | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-embedded | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-embedded | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-enchant | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-enchant | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-ffi | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-ffi | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-fpm | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-fpm | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-gd | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-gd | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-gmp | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-gmp | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-intl | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-intl | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-ldap | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-ldap | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-mbstring | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-mbstring | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-mysqlnd | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-mysqlnd | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-odbc | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-odbc | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-opcache | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-opcache | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-pdo | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-pdo | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-pecl-apcu | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-apcu | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-apcu-devel | 0 | 5.1.21-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-apcu-devel | 0 | 5.1.23-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-rrd | 0 | 2.0.3-4.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-rrd | 0 | 2.0.3-4.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-xdebug3 | 0 | 3.1.4-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-xdebug3 | 0 | 3.2.2-2.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pecl-zip | 0 | 1.20.1-1.module_el9.1.0+15+94ba28e4 |
| AlmaLinux:9 | php-pecl-zip | 0 | 1.22.3-1.module_el9.4.0+65+49ff6472 |
| AlmaLinux:9 | php-pgsql | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-pgsql | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-process | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-process | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-snmp | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-snmp | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-soap | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-soap | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| AlmaLinux:9 | php-xml | 0 | 8.1.32-1.module_el9.5.0+156+9f1cd3fd |
| AlmaLinux:9 | php-xml | 0 | 8.2.28-1.module_el9.6.0+165+cf879a7c |
| Bitnami | libphp | 0 | 8.1.31 |
| Bitnami | php | 0 | 8.1.31 |
| Bitnami | php | 8.1.0 | 8.1.31 |
| Bitnami | php-min | 0 | 8.1.31 |
| Bitnami | php-min | 8.1.0 | 8.1.31 |
| Chainguard | php-8.1 | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-apache | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bcmath | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bcmath-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bz2 | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-bz2-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-calendar | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-calendar-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-cgi | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ctype | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ctype-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-curl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-curl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dbg | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dev | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-doc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dom | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-dom-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-exif | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-exif-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fileinfo | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fileinfo-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fpm | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-fpm-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ftp | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ftp-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gd | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gd-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gettext | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gettext-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gmp | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-gmp-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-iconv | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-iconv-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-intl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-intl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ldap | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-ldap-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mbstring | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mbstring-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqli | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqli-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqlnd | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-mysqlnd-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-odbc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-odbc-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-opcache | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-opcache-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-openssl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-openssl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pcntl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pcntl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_dblib | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_dblib-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_mysql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_mysql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_odbc | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_odbc-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_pgsql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_pgsql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_sqlite | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pdo_sqlite-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pear | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pgsql | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-pgsql-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-phar | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-phar-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-posix | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-posix-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-simplexml | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-simplexml-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-soap | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-soap-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sockets | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sockets-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sodium | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sodium-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvsem | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvsem-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvshm | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-sysvshm-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xml | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xml-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlreader | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlreader-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlwriter | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xmlwriter-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xsl | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-xsl-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-zip | 0 | 8.1.31-r0 |
| Chainguard | php-8.1-zip-config | 0 | 8.1.31-r0 |
| Chainguard | php-8.3 | 0 | 8.3.14-r0 |
| Chainguard | php-8.3-apache | 0 | 8.3.14-r0 |
| Chainguard | php-8.3-bcmath | 0 | 8.3.14-r0 |
| Chainguard | php-8.3-bcmath-config | 0 | 8.3.14-r0 |
Related vulnerabilities
- CVE-2024-11233 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an… Also affects apcu-panel
- CVE-2024-11234 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using… Also affects apcu-panel
- CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using… Also affects apcu-panel
- CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12… Also affects apcu-panel
- CVE-2024-8925 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous… Also affects apcu-panel
- CVE-2024-2756 Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j… Also affects apcu-panel
- CVE-2023-0567 In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify()… Also affects apcu-panel
- CVE-2022-31631 A flaw was found in PHP. Also affects apcu-panel