CVE-2017-7272 | BDVDB-2026-83283 Detail
Description#
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.securityfocus.com/bid/97178
- http://www.securitytracker.com/id/1038158
- https://bugs.php.net/bug.php?id=75505
- https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt
- https://bugs.php.net/bug.php?id=74216
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.