Critical Security Vulnerability in php-pear Package: Red Hat Advisory RHSA-2022:7340
Summary
RHSA-2022:7340: Red Hat Security Advisory: php-pear security update. Affects php-pear versions < 1:1.9.4-23.el7_9. Fixed in 1:1.9.4-23.el7_9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php-pear package is a framework and distribution system for reusable PHP components. It allows developers to easily install and manage PHP libraries and packages, enhancing the functionality of PHP applications. However, vulnerabilities in this package can expose applications to security risks, making it crucial for users to stay updated with the latest security patches.
Vulnerability Detail
The vulnerabilities identified in the php-pear package, specifically CVE-2020-28948, CVE-2020-28949, and CVE-2020-36193, stem from improper input validation and insufficient sanitization of user inputs. These flaws can lead to remote code execution, allowing attackers to execute arbitrary code on the server, potentially compromising sensitive data and system integrity. The CVSS score of this vulnerability is 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
1:1.9.4-23.el7_9
This is the first release that contains the fix.
sudo dnf update php-pearTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the php-pear package or disable its functionality until the package is updated. However, this is not a long-term solution and should only be used if immediate patching is not feasible.
Conclusion
The php-pear package has critical vulnerabilities that can severely impact the security of applications using it. It is essential to update to the patched version to mitigate these risks. Users should also consider utilizing tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for php-pear →
FAQ
php-pear is a framework and distribution system for reusable PHP components, allowing developers to manage PHP libraries easily.
The vulnerabilities can lead to remote code execution, allowing attackers to execute arbitrary code and potentially compromise sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can update the php-pear package by running the command 'sudo yum update php-pear' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for php-pear.
