CVE-2024-2961 - Githubissues

uselagoon / lagoon-images

This repository builds the images used in Lagoon and local development environments

Apache License 2.0

27 stars 32 forks source link

CVE-2024-2961 #984

Open rocketeerbkw opened 4 months ago

rocketeerbkw commented 4 months ago

There are rumors of a very bad PHP exploit going to be announced in mid May. If true, it may allow full RCE of any PHP application exposed to the internet. It depends on a security flaw in glibc assigned CVE-2024-2961.

The Lagoon PHP images are based on alpine linux, which uses musl, not glibc. At this time we believe our images are not vulnerable to the exploit.

We will update this issues as more information comes out.

rocketeerbkw commented 4 months ago

Some other references:

https://www.offensivecon.org/speakers/2024/charles-fol.html
https://www.offensivecon.org/speakers/2024/charles-fol.html
https://rockylinux.org/news/glibc-vulnerability-april-2024/
https://garrettmills.dev/blog/2024/04/22/Mitigating-the-iconv-Vulnerability-for-PHP-CVE-2024-2961/

smlx commented 4 months ago

AFAIK we aren't vulnerable to this. Can we close this issue?