Summary
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
* php: Local privilege escalation via PHP-FPM (CVE-2021-21703)
* php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | libzip | 0:1.6.1-1.module+el8.6.0+789+2130c178 |
| Rocky Linux · 8 | libzip | 0:1.6.1-1.module+el8.4.0+415+e936cba3 |
| Rocky Linux · 8 | php | 0:7.4.19-2.module+el8.6.0+789+2130c178 |
| Rocky Linux · 8 | php-pear | 1:1.10.12-1.module+el8.4.0+415+e936cba3 |
| Rocky Linux · 8 | php-pear | 1:1.10.12-1.module+el8.6.0+789+2130c178 |
| Rocky Linux · 8 | php-pecl-apcu | 0:5.1.18-1.module+el8.6.0+789+2130c178 |
| Rocky Linux · 8 | php-pecl-apcu | 0:5.1.18-1.module+el8.4.0+415+e936cba3 |
| Rocky Linux · 8 | php-pecl-rrd | 0:2.0.1-1.module+el8.4.0+414+2e7afcdd |
| Rocky Linux · 8 | php-pecl-xdebug | 0:2.9.5-1.module+el8.4.0+415+e936cba3 |
| Rocky Linux · 8 | php-pecl-zip | 0:1.18.2-1.module+el8.6.0+789+2130c178 |
| Rocky Linux · 8 | php-pecl-zip | 0:1.18.2-1.module+el8.4.0+415+e936cba3 |
Vulnerabilities 2
-
High 7.8
PHP-FPM memory access in root process leading to privilege escalation
In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child proc…
-
Medium 4.3
Incorrect URL validation in FILTER_VALIDATE_URL
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to t…