Critical Vulnerabilities in PHP Packages: php5 and php7.0
Summary
USN-5006-2: php5, php7.0 vulnerabilities. Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm14. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and integration capabilities with various databases. The packages php5 and php7.0 are essential components in many web applications, providing the core functionalities required to run PHP scripts. However, recent vulnerabilities have been discovered that could potentially compromise the security of applications relying on these packages.
Vulnerability Detail
The vulnerabilities identified in PHP include issues with handling PHAR files, parsing URLs with passwords, and processing malformed XML data in the SOAP extension. These vulnerabilities could allow remote attackers to cause PHP to crash, leading to denial of service, or to manipulate data, potentially resulting in sensitive information exposure or server-side request forgery attacks. Specifically, the vulnerabilities are tracked under CVE-2020-7068, CVE-2020-7071, CVE-2021-21702, CVE-2021-21704, and CVE-2021-21705.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the use of PHAR files and restricting URL parsing in your PHP configuration as a temporary workaround. This can be done by modifying the php.ini file:
; Disable PHAR phar.readonly = On
; Restrict URL parsing allow_url_fopen = Off allow_url_include = Off
Conclusion
The vulnerabilities identified in the PHP packages php5 and php7.0 pose significant risks to web applications. It is crucial for developers and system administrators to promptly update their PHP installations to the patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for php5 →
FAQ
The main vulnerabilities include issues with PHAR file handling, URL parsing, and XML data processing, which can lead to denial of service and data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If you cannot update immediately, consider applying temporary workarounds such as disabling PHAR files and restricting URL parsing in your PHP configuration.
While specific exploits may not be publicly available, the vulnerabilities could potentially be exploited by attackers to cause service disruptions or data breaches.
It is recommended to regularly check for vulnerabilities, ideally on a weekly basis, and to stay updated with security advisories related to your software dependencies.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
