lightswitch05 avatar PHP Version Audit: Source on Github

Github Stars GitHub Workflow Status Packagist Version Docker Pulls license last commit commit activity

PHP Version Audit is a convenience tool to easily check a given PHP version against a regularly updated list of CVE exploits, new releases, and end of life dates.

PHP Version Audit is not: exploit detection/mitigation, vendor-specific version tracking, a replacement for staying informed on PHP releases and security exploits.

Index

Features

Example

docker run --rm -t lightswitch05/php-version-audit:latest --version=8.0.12
{
    "auditVersion": "8.0.12",
    "hasVulnerabilities": true,
    "hasSecuritySupport": true,
    "hasActiveSupport": true,
    "isLatestPatchVersion": false,
    "isLatestMinorVersion": false,
    "isLatestVersion": false,
    "latestPatchVersion": "8.0.14",
    "latestMinorVersion": "8.1.1",
    "latestVersion": "8.1.1",
    "activeSupportEndDate": "2022-11-26T00:00:00+0000",
    "securitySupportEndDate": "2023-11-26T00:00:00+0000",
    "rulesLastUpdatedDate": "2022-01-18T02:13:52+0000",
    "vulnerabilities": {
        "CVE-2021-21707": {
            "id": "CVE-2021-21707",
            "baseScore": 5.3,
            "publishedDate": "2021-11-29T07:15:00+0000",
            "lastModifiedDate": "2022-01-04T16:12:00+0000",
            "description": "In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended."
        }
    }
}

Usage

Docker

Running with docker is the preferred and easiest way to use PHP Version Audit.

Check a specific version of PHP using Docker: docker run --rm -t lightswitch05/php-version-audit:latest --version=8.1.1

Check the host's PHP version using Docker: docker run --rm -t lightswitch05/php-version-audit:latest --version=$(php -r 'echo phpversion();')

Run behind an HTTPS proxy (for use on restricted networks). Requires a volume mount of a directory with your trusted cert (with .crt extension) - see update-ca-certificates for more details. docker run --rm -t -e https_proxy='https://your.proxy.server:port/' --volume /full/path/to/trusted/certs/directory:/usr/local/share/ca-certificates lightswitch05/php-version-audit:latest --version=8.1.1

CLI

Not using docker? Not a problem. It is a couple more steps, but it is just as easy to run directly.

Install the package via composer: composer require lightswitch05/php-version-audit:~1.0

Execute the PHP script, checking the run-time version of PHP: ./vendor/bin/php-version-audit

Produce an exit code if any CVEs are found ./vendor/bin/php-version-audit --fail-security

Direct Invocation

Want to integrate with PHP Version Audit? That's certainly possible. A word caution, this is a very early release. I do not have any plans for breaking changes, but I'm also not committed to keeping the interface as-is if there are new features to implement. Docker/CLI is certainly the preferred method over direct invocation. $phpVersionAudit = new lightswitch05\PhpVersionAudit\Application(phpversion(), false);
$phpVersionAudit->hasVulnerabilities(); #=> true
$phpVersionAudit->getLatestPatchVersion(); #=> '8.1.1'

JSON Rules

The data used to drive PHP Version Audit is automatically updated on a regular basis and is hosted on GitHub pages. This is the real meat-and-potatoes of PHP Version Audit, and you can consume it directly for use in other tools. If you choose to do this, please respect the project license by giving proper attribution notices. Also, I ask any implementations to read the lastUpdatedDate and fail if it has become out of date (2+ weeks). This should not happen since it is automatically updated… but we all know how fragile software is.

Get the latest PHP 8.1 release version directly from the rules using curl and jq: curl -s https://www.github.developerdan.com/php-version-audit/rules-v1.json | jq '.latestVersions["8.1"]'

Options

--help
show arguments help message and exit.
--version=VERSION
set the PHP Version to run against. Defaults to the runtime version. This is required when running with docker.
--fail-security
generate a 10 exit code if any CVEs are found, or security support has ended.
--fail-support
generate a 20 exit code if the version of PHP no longer gets active (bug) support.
--fail-patch
generate a 30 exit code if there is a newer patch-level release.
--fail-latest
generate a 40 exit code if there is a newer release.
--no-update
do not download the latest rules. NOT RECOMMENDED!
--silent
do not write any error messages to STDERR.
--v
Set verbosity. v=warnings, vv=info, vvv=debug. Default is error. All logging writes to STDERR.

Output

• auditVersion: string
The version of PHP that is being audited.
• hasVulnerabilities: bool
If the auditVersion has any known CVEs or not.
• hasSecuritySupport: bool
If the auditVersion is still receiving security updates.
• hasActiveSupport: bool
If the auditVersion is still receiving active support (bug updates).
• isLatestPatchVersion: bool
If auditVersion is the latest patch-level release (8.0.x).
• isLatestMinorVersion: bool
If auditVersion is the latest minor-level release (8.x.x).
• isLatestVersion: bool
If auditVersion is the latest release (x.x.x).
• latestPatchVersion: string
The latest patch-level version for auditVersion.
• latestMinorVersion: string
The latest minor-level version for auditVersion.
• latestVersion: string
The latest PHP version.
• activeSupportEndDate: string|null
ISO8601 formatted date for the end of active support for auditVersion (bug fixes).
• securitySupportEndDate: string
ISO8601 formatted date for the end of security support for auditVersion.
• rulesLastUpdatedDate: string
ISO8601 formatted date for the last time the rules were auto-updated (twice a day).
• vulnerabilities: object
CVEs known to affect auditVersion with details about the CVE. CVE Details might be null for recently discovered CVEs.

Project Goals

License & Acknowledgments