Summary
libzip
[1.6.1-1]
- update to 1.6.1
- enable lzma support
php
[7.4.33-2]
- fix low/moderate CVEs
RHEL-66589
- Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
CVE-2024-8927
- Fix Logs from childrens may be altered
CVE-2024-9026
- Fix Erroneous parsing of multipart form data
CVE-2024-8925
- Fix filter bypass in filter_var FILTER_VALIDATE_URL
CVE-2024-5458
- Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
CVE-2024-2756
- Fix password_verify can erroneously return true opening ATO risk
CVE-2024-3096
- Fix Security issue with external entity loading in XML without enabling it
CVE-2023-3823
- Fix Buffer mismanagement in phar_dir_read()
CVE-2023-3824
- Fix Missing error check and insufficient random bytes in HTTP Digest
authentication for SOAP
CVE-2023-3247
- fix #81744: Password_verify() always return true with some hash
CVE-2023-0567
- fix #81746: 1-byte array overrun in common path resolve code
CVE-2023-0568
- fix DOS vulnerability when parsing multipart request body
CVE-2023-0662
php-pear
[1:1.10.13-1]
- update PEAR to 1.10.13
- update Archive_Tar to 1.4.14
php-pecl-apcu
[5.1.18-1]
- update to 5.1.18
php-pecl-rrd
[2.0.1-1]
- build for RHEL 8
php-pecl-xdebug
php-pecl-zip
[1.18.2-1]
- update to 1.18.2
Fixed packages 37
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | apcu-panel | 0:5.1.18-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | libzip | 0:1.6.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | libzip-devel | 0:1.6.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | libzip-tools | 0:1.6.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-bcmath | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-cli | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-common | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-dba | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-dbg | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-devel | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-embedded | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-enchant | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-ffi | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-fpm | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-gd | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-gmp | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-intl | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-json | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-ldap | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-mbstring | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-mysqlnd | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-odbc | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-opcache | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pdo | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pear | 1:1.10.13-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-apcu | 0:5.1.18-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-apcu-devel | 0:5.1.18-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-rrd | 0:2.0.1-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pecl-zip | 0:1.18.2-1.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-pgsql | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-process | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-snmp | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-soap | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-xml | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
| Oracle Linux · 8 | php-xmlrpc | 0:7.4.33-2.module+el8.10.0+90472+f810484b |
Vulnerabilities 11
-
Critical 9.4
Buffer overflow and overread in phar_dir_read()
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
-
High 8.6
Security issue with external entity loading in XML without enabling it
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the us…
-
High 7.7
password_verify() always returns true for some invalid hashes
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any passwor…
-
High 7.5
Array overrun in common path resolve code
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffe…
-
High 7.5
cgi.force_redirect configuration is bypassable due to the environment variable collision
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be control…
-
Medium 6.5CVE-2024-2756 EPSS 38%
__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
-
Medium 6.5
PHP function password_verify can erroneously return true when argument contains NUL
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
-
Medium 5.3CVE-2024-5458 EPSS 12%
Filter bypass in filter_var (FILTER_VALIDATE_URL)
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user infor…
-
Low 3.3
PHP-FPM logs from children may be altered
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters fr…
-
Low 3.1
Erroneous parsing of multipart form data
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control …
-
Low 2.6
Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generato…