Moderate: php:8.1 security update
Summary
ALSA-2023:2417: Moderate: php:8.1 security update. Affects apcu-panel versions < 5.1.21-1.module_el9.1.0+15+94ba28e4. Fixed in 5.1.21-1.module_el9.1.0+15+94ba28e4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The php package is a core component of PHP and is responsible for executing PHP scripts on the server side. It is widely used in web development and powers numerous websites and web applications.
Vulnerability Detail
The php:8.1 security update addresses multiple security vulnerabilities:
-
XKCP: A buffer overflow vulnerability in the SHA-3 reference implementation (CVE-2022-37454). This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
-
Insecure cookie handling: PHP applications could treat a standard insecure cookie as a '__Host-' or '__Secure-' cookie (CVE-2022-31629). This could lead to security bypass or session hijacking.
-
Out-of-bounds read: The imageloadfont() function in PHP is vulnerable to an out-of-bounds read due to insufficient input validation (CVE-2022-31630). An attacker could exploit this vulnerability to leak sensitive information or cause a denial of service.
-
Integer overflow: The PDO::quote() function in PHP may return an unquoted string due to an integer overflow (CVE-2022-31631). This could lead to SQL injection attacks or other security vulnerabilities.
-
Infinite loop: The phar extension in PHP is vulnerable to an infinite loop when decompressing a quine gzip file (CVE-2022-31628). An attacker could exploit this vulnerability to cause a denial of service.
These vulnerabilities have a moderate impact and could potentially be exploited by remote attackers to execute arbitrary code, bypass security measures, or cause a denial of service.
How To Fix
Minimum fixed version
5.1.21-1.module_el9.1.0+15+94ba28e4
This is the first release that contains the fix.
sudo dnf update apcu-panelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible to mitigate the risk.
Conclusion
The php:8.1 security update addresses multiple vulnerabilities in the PHP package. It is important to update to the latest version to ensure the security and stability of your PHP applications. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for apcu-panel →
FAQ
PHP is an HTML-embedded scripting language commonly used for web development.
These vulnerabilities could allow remote attackers to execute arbitrary code, bypass security measures, or cause a denial of service.
To fix these vulnerabilities, update the php package to version 8.1.14 or later.
There are no known workarounds for these vulnerabilities. Applying the security update is the recommended solution.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for apcu-panel.
