Moderate: php security, bug fix, and enhancement update
Summary
RLSA-2022:8197: Moderate: php security, bug fix, and enhancement update. Affects php versions < 0:8.0.20-3.el9. Fixed in 0:8.0.20-3.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The vulnerability affects the php package in Rocky Linux 9. PHP version 8.0.20 has been upgraded to address security issues, bugs, and enhancements.
Vulnerability Detail
The vulnerability identified as CVE-2021-21708 is a use-after-free vulnerability caused by the php_filter_float() function failing for integers. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial of service. The second vulnerability, CVE-2022-31625, involves an uninitialized array in the pg_query_params() function, which could lead to remote code execution. Both vulnerabilities have a CVSS score of 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
0:8.0.20-3.el9
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
In conclusion, the php package in Rocky Linux 9 is affected by two critical vulnerabilities (CVE-2021-21708 and CVE-2022-31625). It is crucial to update the package to version 8.0.20-3.el9 to mitigate these vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for php →
FAQ
The vulnerabilities could allow an attacker to execute arbitrary code or cause a denial of service.
There are no known exploits at the time of this report.
Yes, it is recommended to restart the Apache HTTP Server after updating the php package to ensure the changes take effect.
Yes, both vulnerabilities can be exploited remotely.
For more details about the vulnerabilities, including the impact, CVSS score, and related information, refer to the CVE pages listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
