Important: php:8.0 security update
Summary
RLSA-2022:5468: Important: php:8.0 security update. Affects libzip versions < 0:1.7.3-1.module+el8.6.0+790+fc63e43f. Fixed in 0:1.7.3-1.module+el8.6.0+790+fc63e43f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The vulnerability affects the php package version 8.0.
Vulnerability Detail
A buffer overflow vulnerability (CVE-2022-31626) has been discovered in the php package version 8.0. This vulnerability can be exploited by an attacker who provides a password of excessive length, leading to remote code execution. The impact of this vulnerability is considered high, with a CVSS score of 8.8.
How To Fix
Minimum fixed version
0:1.7.3-1.module+el8.6.0+790+fc63e43f
This is the first release that contains the fix.
sudo dnf update libzipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the php package to the fixed version.
Conclusion
In conclusion, the php package version 8.0 is affected by a buffer overflow vulnerability that can lead to remote code execution. It is crucial to update the package to the fixed version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libzip →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to a complete compromise of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It provides real-time monitoring and alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is crucial to update the php package to the fixed version.
The only effective mitigation is to update the php package to the fixed version. Regularly applying security updates is recommended to prevent such vulnerabilities.
This vulnerability was discovered by the Rocky Enterprise Software Foundation and reported to the php maintainers. It has been assigned CVE-2022-31626.
Related vulnerabilities
Recent vulnerabilities recorded for libzip.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
