Summary
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
Products not listed in the Impact Details section have not been evaluated. Furthermore, products that have exceeded any software maintenance time periods are also not evaluated and will not be published. Please consult End of Sale and End of Service Life - Extreme Networks for the EOL notices related to the product under question.
Products Potentially Affected
None
Impact Details
|
OS/Product
|
Exposure
|
|
ExtremeAnalytics for Site Engine
|
No
|
|
ExtremeCloud IQ (XIQ)
|
No
|
|
ExtremeCloud IQ - Site Engine (XIQ-SE)
|
No
|
|
ExtremeCloud Orchestrator (XCO/EFA)
|
No
|
|
Extreme Platform ONE
|
No
|
|
Extreme AirDefense
|
No
|
|
ExtremeCloud A3
|
No
|
|
ExtremeCloud Universal ZTNA
|
No
|
|
ExtremeControl for Site Engine
|
Investigating
|
|
ExtremeCloud SD-WAN Appliance
|
No
|
|
ExtremeCloud SD-WAN Orchestrator
|
No
|
|
Extreme OS ONE
|
No
|
|
Fabric Engine (VOSS)
|
No
|
|
SLX-OS
|
No
|
|
Switch Engine (EXOS)
|
No
|
|
CampusWirelessAP
|
No
|
|
ExtremeCloud IQ Controller (IQC/XCC)
|
No
|
|
IQ Engine (HiveOS)
|
Investigating
|
|
WiNG
|
Investigating
|
Repair Recommendations
None
Please see the full Security Advisory here for more details and future updates.
