CVE-2024-9026
MediumSummary
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.
Risk Assessment
An attacker could forge log entries, hindering security auditing and masking other attacks.
Recommendation
Upgrade PHP to version 8.1.30, 8.2.24, 8.3.12 or later, and consider disabling catch_workers_output if not required.
Original NVD description (English source)
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log m