Moderate: php security update
Summary
RLSA-2023:0965: Moderate: php security update. Affects php versions < 0:8.0.27-1.el9_1. Fixed in 0:8.0.27-1.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It allows developers to create dynamic web pages and applications. The vulnerability affects the php package in Rocky Linux 9. The package has been upgraded to version 8.0.27 to address this issue.
Vulnerability Detail
The vulnerability (CVE-2022-37454) is a buffer overflow in the SHA-3 reference implementation. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service. Another vulnerability (CVE-2022-31629) allows a standard insecure cookie to be treated as a __Host- or __Secure- cookie by PHP applications, potentially leading to session hijacking or other security issues. Additionally, there are vulnerabilities (CVE-2022-31630, CVE-2022-31631) that could result in out-of-bounds reads and integer overflow, respectively, leading to potential information disclosure or code execution. Lastly, a vulnerability (CVE-2022-31628) in the phar wrapper can cause denial of service when using a quine gzip file.
How To Fix
Minimum fixed version
0:8.0.27-1.el9_1
This is the first release that contains the fix.
sudo dnf update phpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the php package in Rocky Linux 9 is affected by multiple vulnerabilities, including a buffer overflow, insecure cookie handling, out-of-bounds read, integer overflow, and denial of service issues. It is crucial to update the php package to version 8.0.27 to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php →
FAQ
PHP is an HTML-embedded scripting language commonly used for web development.
The buffer overflow vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability without any signup or installation.
No, updating to the latest version of the php package is the recommended solution.
You can refer to the CVE pages listed in the References section of the vulnerability details for more information.
References
Related vulnerabilities
Recent vulnerabilities recorded for php.
