PHP 5

CVE-2018-17082 is a bug in PHP's Apache2 handler (sapi/apache2handler) where a crafted Transfer-Encoding: chunked request can cause attacker-controlled request body data to be echoed back in the HTTP response. For this specific Tenable finding, the directly affected upstream range is PHP 5.6.x before 5.6.38; broader upstream exposure also covered 7.0.x < 7.0.32, 7.1.x < 7.1.22, and 7.2.x < 7.2.10.

The vendor's MEDIUM label is defensible in CVSS terms, but it overstates operational urgency for enterprise patch queues. Real exploitation depends on a brittle chain: the target must be using Apache mod_php rather than PHP-FPM/CGI, the malformed chunked request has to survive intermediaries, and impact usually needs either victim browser rendering or a cache-poisoning side path rather than direct server compromise.

Why this verdict

• Requires the old handler path: this bug lives in sapi/apache2handler; PHP-FPM/CGI estates don't carry the same exposure, which cuts the reachable population hard.
• Needs malformed HTTP to reach origin: the attacker must deliver a crafted Transfer-Encoding: chunked request through proxies, WAFs, CDNs, and load balancers that commonly normalize or reject it.
• Impact is client-side, not server-side: even when triggered, the endgame is browser-context script execution or cache poisoning, not direct RCE, auth bypass, or data-at-rest compromise on the server.

Why not higher?

This is not a pre-auth server takeover and not even a reliable reflected XSS in the usual sense. It depends on user interaction or cache behavior after a malformed request reaches a specific legacy deployment model, which is too much friction for a HIGH or CRITICAL patch priority.

Why not lower?

It is still unauthenticated remote input against an internet-facing surface, and if the chain lands, the attacker can execute script in the application's origin context. On legacy estates still running Apache mod_php and weak cache controls, there is enough real residual risk that this should stay above IGNORE.

1. Block malformed chunked requests at the edge — Enforce strict HTTP parsing on WAFs, reverse proxies, and load balancers so malformed Transfer-Encoding: chunked traffic never reaches Apache. For a LOW verdict there is no mitigation SLA; treat this as backlog hygiene unless the asset is especially sensitive or internet-exposed legacy PHP.
2. Disable caching of dynamic and error responses — Reduce the more plausible abuse path by ensuring dynamic pages and error responses are not stored by shared proxies/CDNs unless explicitly intended. For a LOW verdict there is no mitigation SLA; fold this into your normal web-tier hardening cycle.
3. Retire mod_php and legacy PHP 5.6 — Move Apache+PHP deployments to supported runtimes, ideally PHP-FPM behind a modern front end, and eliminate PHP 5.6 entirely. For a LOW verdict there is no mitigation SLA; schedule it as backlog hygiene, but treat the broader EOL platform risk separately from this CVE.

Run this on the target Linux web server, not from an auditor workstation. Invoke it as sudo bash ./check-cve-2018-17082.sh; root is recommended so Apache module queries succeed, but it will still try a best-effort check without full privileges.

#!/usr/bin/env bash
# check-cve-2018-17082.sh
# Determine likely exposure to CVE-2018-17082 for Apache+PHP hosts.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched/not-applicable, 2=unknown

set -u

say() {
  echo "$1"
}

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

version_lt() {
  # Returns 0 if $1 < $2 using sort -V, else 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

apache_cmd=""
for c in apache2ctl apachectl httpd; do
  if have_cmd "$c"; then
    apache_cmd="$c"
    break
  fi
done

if [ -z "$apache_cmd" ]; then
  # No Apache control binary found; this Tenable finding is Apache-specific.
  say "PATCHED"
  exit 0
fi

mods="$($apache_cmd -M 2>/dev/null || true)"
if [ -z "$mods" ]; then
  # Could not inspect modules; continue, but confidence drops.
  mods=""
fi

# Check whether Apache appears to load a PHP module.
if ! printf '%s' "$mods" | grep -Eiq 'php[0-9_]*_module|php_module'; then
  # No mod_php detected; CVE-2018-17082 is in sapi/apache2handler.
  say "PATCHED"
  exit 0
fi

# Try distro package checks first for known backports.
if have_cmd dpkg-query; then
  # Ubuntu/Debian backport examples from vendor advisory data.
  if dpkg-query -W -f='${Package} ${Version}\n' 2>/dev/null | grep -q '^php5 '; then
    pkgver="$(dpkg-query -W -f='${Version}' php5 2>/dev/null || true)"
    if [ -n "$pkgver" ] && dpkg --compare-versions "$pkgver" ge '5.5.9+dfsg-1ubuntu4.26'; then
      say "PATCHED"
      exit 0
    fi
  fi
fi

php_ver=""
if have_cmd php-config; then
  php_ver="$(php-config --version 2>/dev/null || true)"
fi
if [ -z "$php_ver" ] && have_cmd php; then
  php_ver="$(php -r 'echo PHP_VERSION;' 2>/dev/null || true)"
fi

if [ -z "$php_ver" ]; then
  say "UNKNOWN"
  exit 2
fi

# Strip suffixes such as -ubuntu or extra build metadata if present.
base_ver="$(printf '%s' "$php_ver" | sed 's/[^0-9.].*$//')"

case "$base_ver" in
  5.6.*)
    if version_lt "$base_ver" '5.6.38'; then
      say "VULNERABLE"
      exit 1
    else
      say "PATCHED"
      exit 0
    fi
    ;;
  7.0.*)
    if version_lt "$base_ver" '7.0.32'; then
      say "VULNERABLE"
      exit 1
    else
      say "PATCHED"
      exit 0
    fi
    ;;
  7.1.*)
    if version_lt "$base_ver" '7.1.22'; then
      say "VULNERABLE"
      exit 1
    else
      say "PATCHED"
      exit 0
    fi
    ;;
  7.2.*)
    if version_lt "$base_ver" '7.2.10'; then
      say "VULNERABLE"
      exit 1
    else
      say "PATCHED"
      exit 0
    fi
    ;;
  *)
    # This specific CVE does not affect other major/minor lines in the cited advisories.
    say "PATCHED"
    exit 0
    ;;
esac

Sources

1. Tenable Nessus plugin 117497
2. NVD CVE-2018-17082
3. PHP security bug #76582
4. PHP 5 changelog (5.6.38 fix)
5. PHP patch commit 23b0577
6. Ubuntu CVE-2018-17082 advisory
7. Tenable blog on the issue
8. CISA Known Exploited Vulnerabilities Catalog