Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-3247: GHSA-76gg-c692-v2mw: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP NOTE: Fixed in 8.2.7, 8.1.20, 8.0.29 NOTE: https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw NOTE: https://github.com/php/php-src/commit/ac4254ad764c70cb1f05c9270d8d12689fc3aeb6 (php-8.0.29) NOTE: https://github.com/php/php-src/commit/32c7c433ac1983c4497349051681a4f361d3d33e (php-8.0.29) ADVISORIES: ['DSA-5425-1', 'DSA-5424-1']
Fixed packages 54
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | php8.1 | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-bcmath | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-bcmath-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-cli | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-cli-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-common | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-common-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-dba | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-dba-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-dbg | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-dbg-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-debugsource | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-devel | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-embedded | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-embedded-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-enchant | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-enchant-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-ffi | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-ffi-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-fpm | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-fpm-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-gd | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-gd-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-gmp | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-gmp-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-intl | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-intl-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-ldap | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-ldap-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-mbstring | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-mbstring-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-mysqlnd | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-mysqlnd-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-odbc | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-odbc-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-opcache | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-opcache-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-pdo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-pdo-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-pgsql | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-pgsql-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-process | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-process-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-pspell | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-pspell-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-snmp | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-snmp-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-soap | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-soap-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-tidy | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-tidy-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-xml | 0:8.1.22-1.amzn2023.0.1 |
| Amazon Linux · 2023 | php8.1-xml-debuginfo | 0:8.1.22-1.amzn2023.0.1 |
Vulnerabilities 1
-
Low 2.6
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generato…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-3247.html