{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "PHP versions earlier than 4.1.0 contain a vulnerability that could allow\narbitrary commands to be executed.\n\n[updated 22 Aug 2002]\nThe initial set of errata packages contained an incorrect set of\ndependencies. This meant that a number of packages would need to be\ninstalled before php that were not essential to the operation of php. \nUpdated errata packages are included with this advisory that have corrected\ndependencies.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "PHP is an HTML-embedded scripting language commonly used with Apache. PHP\nversions 4.0.5 through 4.1.0 in safe mode do not properly cleanse the 5th\nparameter to the mail() function. This vulnerability allows local users and\npossibly remote attackers to execute arbitrary commands via shell\nmetacharacters.\n\nRed Hat Linux Advanced Server version 2.1 shipped with PHP 4.0.6.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2001-1246 to this issue.\n \nAll users of PHP should upgrade to these errata packages containing PHP\n4.1.2, which is not vulnerable to this issue.\n\nNote:\n\nThis PHP errata enforces memory limits on the size of the PHP process to\nprevent a badly generated script from becoming a possible source for a\ndenial of service attack. The default process size is 8Mb though you can\nadjust this as you deem necessary thought the php.ini directive\nmemory_limit. For example, to change the process memory limit to 4MB, add\nthe following:\n\nmemory_limit 4194304\n\nImportant Installation Note:\n\nThere are special instructions you should follow regarding your\n/etc/php.ini configuration file in the \"Solution\" section below.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:129",
        "url": "https://access.redhat.com/errata/RHSA-2002:129"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_129.json"
      }
    ],
    "title": "Red Hat Security Advisory: php security update",
    "tracking": {
      "current_release_date": "2024-11-21T22:23:14+00:00",
      "generator": {
        "date": "2024-11-21T22:23:14+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:129",
      "initial_release_date": "2002-06-26T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2002-06-26T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-06-26T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:23:14+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                "product": {
                  "name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "product_id": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:2.1::as"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2001-1246",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616654"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 "
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2001-1246"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616654",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616654"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2001-1246",
          "url": "https://www.cve.org/CVERecord?id=CVE-2001-1246"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1246",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1246"
        }
      ],
      "release_date": "2001-06-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-06-26T00:00:00+00:00",
          "details": "Please Note:\n\nThe /etc/php.ini configuration file is not replaced or\noverwritten. You should carefully review your configuration file and adapt\nit to your server or service functions.\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network.  To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 "
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:129"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}