Moderate: php:7.4 security, bug fix, and enhancement update
Summary
ALSA-2022:7628: Moderate: php:7.4 security, bug fix, and enhancement update. Affects apcu-panel versions < 5.1.18-1.module_el8.6.0+2750+78feabcb. Fixed in 5.1.18-1.module_el8.6.0+2750+78feabcb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The php package is a core component of PHP, providing the necessary runtime environment for executing PHP scripts.
Vulnerability Detail
The php:7.4 package is affected by multiple vulnerabilities:
-
Special character breaks path in XML parsing (CVE-2021-21707): This vulnerability allows an attacker to manipulate XML parsing by using special characters in the path, potentially leading to unauthorized access or information disclosure.
-
Use after free due to php_filter_float() failing for ints (CVE-2021-21708): This vulnerability allows an attacker to trigger a use-after-free condition by passing an integer value to the php_filter_float() function, potentially leading to arbitrary code execution.
-
Directory traversal vulnerability in php-pear (CVE-2021-32610): This vulnerability allows an attacker to bypass file path restrictions and read arbitrary files on the system, potentially leading to information disclosure or further exploitation.
How To Fix
Minimum fixed version
5.1.18-1.module_el8.6.0+2750+78feabcb
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The php:7.4 package is affected by multiple vulnerabilities that could potentially lead to unauthorized access, information disclosure, or arbitrary code execution. It is crucial to update the php package to version 7.4.30 to address these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apcu-panel →
FAQ
PHP is a popular scripting language used for web development. It allows developers to create dynamic web pages and applications.
The php package is a core component of PHP, providing the necessary runtime environment for executing PHP scripts.
This update addresses three vulnerabilities: CVE-2021-21707, CVE-2021-21708, and CVE-2021-32610. These vulnerabilities could potentially lead to unauthorized access, information disclosure, or arbitrary code execution.
You can update the php package by using the package manager of your operating system or by manually downloading and installing the updated package from the official PHP website.
No specific workarounds are mentioned for these vulnerabilities. It is recommended to update the php package to the latest version to mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
