Headline
Ubuntu Security Notice USN-6199-2
Ubuntu Security Notice 6199-2 - USN-6199-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that PHP incorrectly handled certain Digest authentication for SOAP. An attacker could possibly use this issue to expose sensitive information.
==========================================================================
Ubuntu Security Notice USN-6199-2
October 23, 2023
php7.0, php7.2 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
PHP could be made to expose sensitive information.
Software Description:
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter
Details:
USN-6199-1 fixed a vulnerability in PHP. This update provides the
corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain Digest
authentication for SOAP. An attacker could possibly use this issue
to expose sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.2 7.2.24-0ubuntu0.18.04.17+esm1
php7.2 7.2.24-0ubuntu0.18.04.17+esm1
php7.2-cgi 7.2.24-0ubuntu0.18.04.17+esm1
php7.2-cli 7.2.24-0ubuntu0.18.04.17+esm1
php7.2-soap 7.2.24-0ubuntu0.18.04.17+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.0 7.0.33-0ubuntu0.16.04.16+esm7
php7.0 7.0.33-0ubuntu0.16.04.16+esm7
php7.0-cgi 7.0.33-0ubuntu0.16.04.16+esm7
php7.0-cli 7.0.33-0ubuntu0.16.04.16+esm7
php7.0-soap 7.0.33-0ubuntu0.16.04.16+esm7
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6199-2
https://ubuntu.com/security/notices/USN-6199-1
CVE-2023-3247
Related news
Red Hat Security Advisory 2024-0387-03 - An update for the php:8.1 module is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.
Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.
Ubuntu Security Notice 6199-1 - It was discovered that PHP incorrectly handled certain Digest authentication for SOAP. An attacker could possibly use this issue to expose sensitive information.