Skip to content
OpenAdvisories
High RLSA-2022:5467 1 CVE

Important: php:7.4 security update

Published Jun 30, 2022 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 11

ReleasePackageFixed in
Rocky Linux · 8 libzip 0:1.6.1-1.module+el8.6.0+789+2130c178
Rocky Linux · 8 libzip 0:1.6.1-1.module+el8.4.0+415+e936cba3
Rocky Linux · 8 php 0:7.4.19-3.module+el8.6.0+990+389ef54a
Rocky Linux · 8 php-pear 1:1.10.12-1.module+el8.4.0+415+e936cba3
Rocky Linux · 8 php-pear 1:1.10.12-1.module+el8.6.0+789+2130c178
Rocky Linux · 8 php-pecl-apcu 0:5.1.18-1.module+el8.6.0+789+2130c178
Rocky Linux · 8 php-pecl-apcu 0:5.1.18-1.module+el8.4.0+415+e936cba3
Rocky Linux · 8 php-pecl-rrd 0:2.0.1-1.module+el8.4.0+414+2e7afcdd
Rocky Linux · 8 php-pecl-xdebug 0:2.9.5-1.module+el8.4.0+415+e936cba3
Rocky Linux · 8 php-pecl-zip 0:1.18.2-1.module+el8.6.0+789+2130c178
Rocky Linux · 8 php-pecl-zip 0:1.18.2-1.module+el8.4.0+415+e936cba3

Vulnerabilities 1

  • High 7.5
    CVE-2022-31626 Public exploit EPSS 58%

    mysqlnd/pdo password buffer overflow

    In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigg…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2098523