Moderate: php:7.4 security update
Summary
ALSA-2023:2903: Moderate: php:7.4 security update. Affects apcu-panel versions < 5.1.18-1.module_el8.6.0+2750+78feabcb. Fixed in 5.1.18-1.module_el8.6.0+2750+78feabcb. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The php:7.4 package is a specific version of PHP that has been widely used in various projects.
Vulnerability Detail
The php:7.4 package is affected by multiple security vulnerabilities:
-
Buffer overflow in the SHA-3 reference implementation (CVE-2022-37454): This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
-
Insecure cookie handling (CVE-2022-31629): PHP applications may treat standard insecure cookies as '__Host-' or '__Secure-' cookies, potentially leading to security issues.
-
Out-of-bounds read in imageloadfont() (CVE-2022-31630): Insufficient input validation in the imageloadfont() function could result in an out-of-bounds read, leading to information disclosure or a crash.
-
Integer overflow in PDO::quote() (CVE-2022-31631): An integer overflow in the PDO::quote() function could cause it to return an unquoted string, potentially leading to SQL injection vulnerabilities.
-
Infinite loop in phar decompression (CVE-2022-31628): A specially crafted quine gzip file could trigger an infinite loop when decompressed by the phar extension, causing a denial of service.
These vulnerabilities pose a moderate risk and could potentially be exploited by attackers to gain unauthorized access, execute arbitrary code, or cause a denial of service.
How To Fix
Minimum fixed version
5.1.18-1.module_el8.6.0+2750+78feabcb
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is strongly recommended to apply the security update as soon as possible.
Conclusion
In conclusion, the php:7.4 package is affected by multiple security vulnerabilities that could potentially be exploited by attackers. It is crucial to update the package to the latest version to mitigate these risks. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for apcu-panel →
FAQ
PHP is an HTML-embedded scripting language commonly used for web development. It allows developers to create dynamic web pages and applications.
These vulnerabilities could allow attackers to execute arbitrary code, gain unauthorized access, or cause a denial of service.
You can update the php package by running the package manager update command for your operating system. For example, on AlmaLinux 8, you can use the following command:
$ sudo dnf update php
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities, including their impact and CVSS scores, on the CVE pages listed in the References section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
