Important: php:7.4 security update
Summary
RLSA-2022:5467: Important: php:7.4 security update. Affects libzip across 2 version ranges.
< 0:1.6.1-1.module+el8.6.0+789+2130c178
< 0:1.6.1-1.module+el8.4.0+415+e936cba3
Fixed in 0:1.6.1-1.module+el8.6.0+789+2130c178 or 0:1.6.1-1.module+el8.4.0+415+e936cba3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The vulnerability affects the PHP package version 7.4.
Vulnerability Detail
The vulnerability (CVE-2022-31626) in the PHP package allows an attacker to trigger a buffer overflow by providing a password of excessive length. This buffer overflow can lead to remote code execution (RCE) on the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level. Successful exploitation of this vulnerability can have serious consequences, including unauthorized access, data breaches, and potential compromise of the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libzip-
< 0:1.6.1-1.module+el8.4.0+415+e936cba30:1.6.1-1.module+el8.4.0+415+e936cba3 -
< 0:1.6.1-1.module+el8.6.0+789+2130c1780:1.6.1-1.module+el8.6.0+789+2130c178
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to apply the security update as soon as possible.
Conclusion
The PHP package version 7.4 is affected by a buffer overflow vulnerability (CVE-2022-31626) that can lead to remote code execution. To mitigate this vulnerability, it is crucial to update the PHP package to version 7.4.19-3.module+el8.6.0+990+389ef54a or later. Failure to apply the necessary security patches can result in unauthorized access, data breaches, and potential compromise of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for libzip →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, and system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits for this vulnerability. However, it is crucial to apply the security update to prevent any potential exploitation.
The primary mitigation is to update the PHP package to the latest version. Additionally, it is recommended to follow secure coding practices, such as input validation and proper handling of user-supplied data, to reduce the risk of exploitation.
You can refer to the CVE page (CVE-2022-31626) for more details about the vulnerability, including its impact, CVSS score, and any related information.
Related vulnerabilities
Recent vulnerabilities recorded for libzip.
