Skip to content
OpenAdvisories
High · 7.7 CVE-2024-5585 EUVD-2024-46774

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

Published Jun 9, 2024 · Updated Feb 13, 2025 · Assigned by php

Vendor: PHP Group Product: PHP Package: php Package: php-8.1 Package: php-8.2 Package: php81 Package: php82 Package: php83 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Wolfi

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Affected products

VendorProductAffectedFixed
PHP Group PHP 8.1.* – < 8.1.29, 8.2.* – < 8.2.20, 8.3.* – < 8.3.8 8.1.29

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.19 php81 8.1.29-r0 —
Alpine v3.19 php82 8.2.20-r0 —
Alpine v3.19 php83 8.3.8-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 php 8.3.8-1 —
Azure Linux 2 (CBL-Mariner) php 8.1.29-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling php-8.1 8.1.29-r0 —
Wolfi rolling php-8.2 8.2.20-r0 —

Advisories 5

References