Stars: 108
Forks: 18
Pull Requests: 173
Issues: 8
Watchers: 5
Last Updated: 2023-09-17 13:20:35
Audit your PHP version for known CVEs and patches
License: Apache License 2.0
Languages: PHP, Makefile, Shell
PHP Version Audit is a convenience tool to easily check a given PHP version against a regularly updated list of CVE exploits, new releases, and end of life dates.
PHP Version Audit is not: exploit detection/mitigation, vendor-specific version tracking, a replacement for staying informed on PHP releases and security exploits.
--fail-security
to set a failure exit code if the given version of PHP has a known CVE or is no longer receiving security updates.docker run --rm -t lightswitch05/php-version-audit:latest --version=8.0.12
{
"auditVersion": "8.0.12",
"hasVulnerabilities": true,
"hasSecuritySupport": true,
"hasActiveSupport": true,
"isLatestPatchVersion": false,
"isLatestMinorVersion": false,
"isLatestVersion": false,
"latestPatchVersion": "8.0.14",
"latestMinorVersion": "8.1.1",
"latestVersion": "8.1.1",
"activeSupportEndDate": "2022-11-26T00:00:00+0000",
"securitySupportEndDate": "2023-11-26T00:00:00+0000",
"rulesLastUpdatedDate": "2022-01-18T02:13:52+0000",
"vulnerabilities": {
"CVE-2021-21707": {
"id": "CVE-2021-21707",
"baseScore": 5.3,
"publishedDate": "2021-11-29T07:15:00+0000",
"lastModifiedDate": "2022-01-04T16:12:00+0000",
"description": "In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended."
}
}
}
Running with docker is the preferred and easiest way to use PHP Version Audit.
Check a specific version of PHP using Docker:
docker run --rm -t lightswitch05/php-version-audit:latest --version=8.1.1
Check the host's PHP version using Docker:
docker run --rm -t lightswitch05/php-version-audit:latest --version=$(php -r 'echo phpversion();')
Run behind an HTTPS proxy (for use on restricted networks). Requires a volume mount of a directory with your trusted cert (with .crt extension) - see update-ca-certificates for more details.
docker run --rm -t -e https_proxy='https://your.proxy.server:port/' --volume /full/path/to/trusted/certs/directory:/usr/local/share/ca-certificates lightswitch05/php-version-audit:latest --version=8.1.1
Not using docker? Not a problem. It is a couple more steps, but it is just as easy to run directly.
Install the package via composer:
composer require lightswitch05/php-version-audit:~1.0
Execute the PHP script, checking the run-time version of PHP:
./vendor/bin/php-version-audit
Produce an exit code if any CVEs are found:
./vendor/bin/php-version-audit --fail-security
Want to integrate with PHP Version Audit? That's certainly possible. A word caution, this is a very early release. I do not have any plans for breaking changes, but I'm also not committed to keeping the interface as-is if there are new features to implement. Docker/CLI is certainly the preferred method over direct invocation.
$phpVersionAudit = new lightswitch05\PhpVersionAudit\Application(phpversion(), false);
$phpVersionAudit->hasVulnerabilities(); #=> true
$phpVersionAudit->getLatestPatchVersion(); #=> '8.1.1'
The data used to drive PHP Version Audit is automatically updated on a regular basis and is hosted on GitHub pages. This is the real meat-and-potatoes of PHP Version Audit, and you can consume it directly for use in other tools. If you choose to do this, please respect the project license by giving proper attribution notices. Also, I ask any implementations to read the lastUpdatedDate
and fail if it has become out of date (2+ weeks). This should not happen since it is automatically updated... but we all know how fragile software is.
Get the latest PHP 8.1 release version directly from the rules using curl and jq:
curl -s https://www.github.developerdan.com/php-version-audit/rules-v1.json | jq '.latestVersions["8.1"]'
usage: php-version-audit [--help] [--version=PHP_VERSION]
[--fail-security] [--fail-support]
[--fail-patch] [--fail-latest]
[--no-update] [--silent]
[--v]
optional arguments:
--help show this help message and exit.
--version set the PHP Version to run against. Defaults to the runtime version. This is required when running with docker.
--fail-security generate a 10 exit code if any CVEs are found, or security support has ended.
--fail-support generate a 20 exit code if the version of PHP no longer gets active (bug) support.
--fail-patch generate a 30 exit code if there is a newer patch-level release.
--fail-latest generate a 40 exit code if there is a newer release.
--no-update do not download the latest rules. NOT RECOMMENDED!
--silent do not write any error messages to STDERR.
--v Set verbosity. v=warnings, vv=info, vvv=debug. Default is error. All logging writes to STDERR.