Cloudanix VulnDB

CVE-2024-9026

None

CVSS

—

EPSS

0.5%

Published

Oct 8, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain PHP setups can let attackers quietly alter or shorten server logs, making it harder to spot or investigate problems.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Network Service
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows manipulation of PHP-FPM worker output logs when catch_workers_output=yes, enabling pollution or removal of up to 4 characters from log messages via crafted content; syslog output permits additional log data removal.

Why it matters to the business

Attackers may tamper with application logs to obscure activity, leading to incomplete audit trails that hinder incident response, forensics, and regulatory compliance.

How an attack unfolds

An attacker supplies specially crafted input that triggers PHP-FPM worker log output; the catch_workers_output mechanism processes the content in a way that pollutes or truncates the final log entries, with syslog configurations allowing further data removal.

How to fix it

Upgrade to PHP 8.1.30, 8.2.24, or 8.3.12 or later. Apply php/php-src commit 773c0eda4ac8181c59a6510a39c37710679277a4 or go-git/v5 5.11.0 where applicable; disable catch_workers_output if immediate patching is not feasible.

How to confirm the fix worked

Confirm deployed PHP version meets or exceeds fixed releases; test with crafted log-triggering inputs to verify no truncation or pollution occurs.

Typical attack path

  1. Confirm PHP-FPM SAPI with catch_workers_output enabled
  2. Craft input containing log-polluting or truncating sequences
  3. Trigger code paths that generate worker log messages
  4. Observe resulting logs for altered or missing content

How to detect it

Search PHP-FPM and syslog logs for sudden character loss, repeated pollution patterns, or unexpected message truncation around worker output events; correlate with application log volume anomalies.

What your security team should do

  • Apply fixed PHP versions immediately given public disclosure
  • Audit all PHP-FPM configurations for catch_workers_output usage
  • Review log integrity monitoring and retention policies
  • Update dependency scanners to flag vulnerable php-src and go-git versions

The record

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 apcu-panel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 apcu-panel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-bcmath 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-bcmath 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-cli 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-cli 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-common 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-common 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dba 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dba 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dbg 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dbg 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-devel 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-devel 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-embedded 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-embedded 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-enchant 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-enchant 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ffi 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ffi 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-fpm 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-fpm 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-intl 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-intl 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-json 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ldap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ldap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mbstring 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mbstring 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mysqlnd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mysqlnd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-odbc 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-odbc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-opcache 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-opcache 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pdo 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pdo 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pear 0 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pear 0 1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.3.0+2009+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.4.0+2229+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+3059+d65eee13
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pecl-xdebug3 0 3.2.2-2.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.22.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pgsql 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pgsql 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-process 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-process 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-snmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-snmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-soap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-soap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xml 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-xml 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xmlrpc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:9 apcu-panel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 apcu-panel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-bcmath 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-bcmath 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-cli 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-cli 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-common 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-common 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dba 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dba 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dbg 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dbg 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-devel 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-devel 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-embedded 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-embedded 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-enchant 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-enchant 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ffi 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ffi 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-fpm 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-fpm 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-intl 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-intl 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ldap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ldap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mbstring 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mbstring 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mysqlnd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mysqlnd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-odbc 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-odbc 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-opcache 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-opcache 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pdo 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pdo 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pecl-apcu 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.2.2-2.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.1.4-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-zip 0 1.22.3-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-zip 0 1.20.1-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pgsql 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pgsql 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-process 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-process 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-snmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-snmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-soap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-soap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-xml 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-xml 0 8.1.30-1.module_el9.5.0+131+62ecd687
Bitnami libphp 0 8.1.30
Bitnami php 0 8.1.30
Bitnami php-min 0 8.1.30
Chainguard php-8.1 0 8.1.30-r0
Chainguard php-8.1-apache 0 8.1.30-r0
Chainguard php-8.1-bcmath 0 8.1.30-r0
Chainguard php-8.1-bcmath-config 0 8.1.30-r0
Chainguard php-8.1-bz2 0 8.1.30-r0
Chainguard php-8.1-bz2-config 0 8.1.30-r0
Chainguard php-8.1-calendar 0 8.1.30-r0
Chainguard php-8.1-calendar-config 0 8.1.30-r0
Chainguard php-8.1-cgi 0 8.1.30-r0
Chainguard php-8.1-config 0 8.1.30-r0
Chainguard php-8.1-ctype 0 8.1.30-r0
Chainguard php-8.1-ctype-config 0 8.1.30-r0
Chainguard php-8.1-curl 0 8.1.30-r0
Chainguard php-8.1-curl-config 0 8.1.30-r0
Chainguard php-8.1-dbg 0 8.1.30-r0
Chainguard php-8.1-dev 0 8.1.30-r0
Chainguard php-8.1-doc 0 8.1.30-r0
Chainguard php-8.1-dom 0 8.1.30-r0
Chainguard php-8.1-dom-config 0 8.1.30-r0
Chainguard php-8.1-exif 0 8.1.30-r0
Chainguard php-8.1-exif-config 0 8.1.30-r0
Chainguard php-8.1-fileinfo 0 8.1.30-r0
Chainguard php-8.1-fileinfo-config 0 8.1.30-r0
Chainguard php-8.1-fpm 0 8.1.30-r0
Chainguard php-8.1-fpm-config 0 8.1.30-r0
Chainguard php-8.1-ftp 0 8.1.30-r0
Chainguard php-8.1-ftp-config 0 8.1.30-r0
Chainguard php-8.1-gd 0 8.1.30-r0
Chainguard php-8.1-gd-config 0 8.1.30-r0
Chainguard php-8.1-gettext 0 8.1.30-r0
Chainguard php-8.1-gettext-config 0 8.1.30-r0
Chainguard php-8.1-gmp 0 8.1.30-r0
Chainguard php-8.1-gmp-config 0 8.1.30-r0
Chainguard php-8.1-iconv 0 8.1.30-r0
Chainguard php-8.1-iconv-config 0 8.1.30-r0
Chainguard php-8.1-intl 0 8.1.30-r0
Chainguard php-8.1-intl-config 0 8.1.30-r0
Chainguard php-8.1-ldap 0 8.1.30-r0
Chainguard php-8.1-ldap-config 0 8.1.30-r0
Chainguard php-8.1-mbstring 0 8.1.30-r0
Chainguard php-8.1-mbstring-config 0 8.1.30-r0
Chainguard php-8.1-mysqli 0 8.1.30-r0
Chainguard php-8.1-mysqli-config 0 8.1.30-r0
Chainguard php-8.1-mysqlnd 0 8.1.30-r0
Chainguard php-8.1-mysqlnd-config 0 8.1.30-r0

Related vulnerabilities