GLSA-201711-15 : PHPUnit: Remote code execution
High Nessus Plugin ID 104696
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201711-15 (PHPUnit: Remote code execution)
When PHPUnit is installed in a production environment via composer and these modules are in a web accessible directory, the eval-stdin.php file in PHPUnit contains vulnerable statements that trigger the vulnerability.
A remote attacker could possibly execute arbitrary PHP code or cause a Denial of Service condition.
There are several ways to fix or mitigate this vulnerability:
Remove PHPUnit from the production environment.
Manually apply the patch.
Disable direct access to the composer packages by placing .htaccess file to /vendor folder.
SolutionAll PHPUnit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-php/phpunit-5.7.15-r1'