Moderate: php security, bug fix, and enhancement update
Summary
ALSA-2022:8197: Moderate: php security, bug fix, and enhancement update. Affects php versions < 8.0.20-3.el9. Fixed in 8.0.20-3.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The php package is a core component of PHP and is responsible for executing PHP scripts. It is widely used in web development and powers numerous websites and applications.
Vulnerability Detail
This update addresses two security vulnerabilities in PHP:
-
CVE-2021-21708: This vulnerability is a use-after-free issue caused by the php_filter_float() function failing for integers. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2022-31625: This vulnerability is an uninitialized array issue in the pg_query_params() function, which could lead to remote code execution. An attacker could exploit this vulnerability to execute arbitrary code on the server.
These vulnerabilities pose a moderate risk and could potentially allow an attacker to execute arbitrary code or cause a denial of service.
How To Fix
Minimum fixed version
8.0.20-3.el9
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this update addresses two security vulnerabilities in PHP that could allow an attacker to execute arbitrary code or cause a denial of service. It is recommended to update the php package to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php →
FAQ
PHP is an HTML-embedded scripting language commonly used for web development.
The php package is a core component of PHP and is responsible for executing PHP scripts.
CVE-2021-21708 is a use-after-free vulnerability in PHP that could allow an attacker to execute arbitrary code or cause a denial of service.
CVE-2022-31625 is an uninitialized array vulnerability in PHP that could lead to remote code execution.
To fix these vulnerabilities, update the php package to version 8.0.20-3.el9 or later.
Related vulnerabilities
Recent vulnerabilities recorded for php.
