Headline

RHSA-2022:6541: Red Hat Security Advisory: php:7.4 security update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2020-28948: Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
CVE-2020-28949: Archive_Tar: improper filename sanitization leads to file overwrites
CVE-2020-36193: Archive_Tar: directory traversal due to inadequate checking of symbolic links

2 years ago

Red Hat Security Data

Open in Source

#sql #vulnerability #linux #red_hat #apache #js #php #ldap #ibm #sap

Synopsis

Moderate: php:7.4 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948)
Archive_Tar: improper filename sanitization leads to file overwrites (CVE-2020-28949)
Archive_Tar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

BZ - 1904001 - CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
BZ - 1910323 - CVE-2020-28949 Archive_Tar: improper filename sanitization leads to file overwrites
BZ - 1942961 - CVE-2020-36193 Archive_Tar: directory traversal due to inadequate checking of symbolic links

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM

libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: ab8126b34de0337c40aa9165a671f01c387fa0f619f07cb007145d20a8059626

php-7.4.6-5.module+el8.4.0+15727+276bb227.src.rpm

SHA-256: 0bd586085f9d718892032eb79c826c0ed90282c3a3ce51688828297a9ffa7648

php-pear-1.10.13-1.module+el8.4.0+16578+ed65e99e.src.rpm

SHA-256: d39316531315607c75a78a0c953b0b10aeffb32a7d43ff62af050ef022c7d8bd

php-pecl-apcu-5.1.18-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 5ef846d350d101cc5ade15412bd9a11c4939dce0d664556a45c7b388d54958dc

php-pecl-rrd-2.0.1-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 2c0dda676d2975cec816811a305cad43d1177f7064cb4f729d6febccceaf1bed

php-pecl-xdebug-2.9.5-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 6cefdd897b02f017aa7f36bb1be5141ccde8baefd17f2e8af1c751315fa48057

php-pecl-zip-1.18.2-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 37aa20b43d46ed37c3d11d64253a9be57307db957ac2de5cf0382f37e2200fd1

x86_64

apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch.rpm

SHA-256: 969124a440bc9018b5ccbf36175195f803908a47e3850e5203922a624b563955

libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 909a4e2bfc39b47266aae1b0e7d50c237ba7f94a6d4c1334e82fa39467fe77da

libzip-debuginfo-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 5b4b202ac79aef3b8000e6e30f966b46bb4aa6aed78ced7657ab4eb5a82cad2a

libzip-debugsource-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 46397c3fe3f18a86771ffd19bda42c704f542c87bc474c37d2e274bf9405d200

libzip-devel-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 190a912a533e67dd94974263dbf311586a0c6b8e80ec8d469e1e93f901881162

libzip-tools-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 94028a5413773f56c98f3f0b4e220a16c0d91c6726fbea08dea26618df3cd9eb

libzip-tools-debuginfo-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 99d5e36d9f94cd6d547176727902ac01f7e341d42e4f575a1461ef6242ccbfb3

php-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: d58db2ba42af024617539fb5f1ff92d4005586eb1f1c9a307224d935f37a7d25

php-bcmath-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: acf2a6aa63ef15c52ab49d3987d97b272a4f5d9067d5ab933b484ffc1744d5df

php-bcmath-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 1e4219125516a0c042360de97819cb269cf89c86760e3b4eebfb386ae95b2c62

php-cli-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: dd7d8413b76e76eecf02502262d2faae6957843a9ba9f94c899223375c3e3301

php-cli-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 4630a6d98196a82aaaa938f61242dcfa4681714f8e6079ce5f859439aa8721c4

php-common-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 42c21551ae0c1ebe451709935ee82a5fc1268df840cb0dab981b5dc5a138eb58

php-common-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: d98c084140d64c379f374a68b7a00c8f5bf7a8de630a068e521540d13eee0fa4

php-dba-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: b823db2db394d38c7cbf780da19f31cce9fc504f8eeef1f3d35a4e9a406c5042

php-dba-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: f5f7b43975c9533cff4721623a7bd6e53a7bdca64953092fdc940bd397a88b4b

php-dbg-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 9743586c7db2712ba794aa17b45fcedf5b6d594d670e8f8dab6065956030c738

php-dbg-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 0850586d2f50acb7564170dbd5417736e3b857db5e00749605a0965d3be53820

php-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 88242f24af9019a102dfd62b2729542fb57c25e0adbfb3a081f031e96b576895

php-debugsource-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 066d5d906387d893844c75d2c387c55fadac1e3e002ff9e7ecb594c54ff4e503

php-devel-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 891691c21a545cd5a1ade6de3c6fcb5fdd8194c6f9eff6b65160d622be7f68eb

php-embedded-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: a7570edad556a1fd5fadc8b9a119360c626f12f8388eb101617c912e41ce858e

php-embedded-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: a715a2d1f5d88acb8a60984ff33739d13217c86aab6ca1f07b398fc88b8b6eec

php-enchant-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: e3aaba0e7170148d0ccd664da7a0be89ce12f2b296222bf2f2b37f61ce07ee58

php-enchant-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: e349ac42d89f54501d5ca348aa91080fe7ca5fc4154c4e793ddc15cab0ab105f

php-ffi-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 18ecda7a9b014b990e29b680d80703c15aae48c8fee3766bdb0aa384124589d8

php-ffi-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 893ea8db21e84096a5b518591a48dc636e223aefa546d8cdab749f5c2dee711a

php-fpm-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 40642143a2fb334f7bae48d6b83f0b5bfba1b4be885a3a907825757aaf19bff1

php-fpm-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 8e9af26d9e3a84e21fea4c5967d06e7403b8df9655297de6a529becdda59d570

php-gd-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 6dbcd9e91d639732cabfcc13107e925dee58c1477dcebb2999700fa25de96c1a

php-gd-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 6c31f4434421e4823d1df4fd232940e96872c0a6bbe8ac1f0b59a5cc237033d1

php-gmp-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 8f14a377d7a8e4935b02bc5cb4d7e251294acf65195d99ec25c1dcce90bd805e

php-gmp-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: c26480e65a5fc719066ac34aee3dab74da7b54dc48170df228b6ef25e66d781f

php-intl-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 1f692ba6e1949131238f4a041d501c5f32a81620a54594d92b9de04ec6df760b

php-intl-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: e8d545e293be20f1d5edd8c3d92b089a90acd082c1784575d85e4a0de9300031

php-json-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 4cbd7697c6999400a0627bbaa1ea9bf11abcf193a2bef57bec9e03acd8743213

php-json-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 5daf383c32a75813ee6d871c7a8efc9bd10fc613bafdbcd6f39171700ef4adcf

php-ldap-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: ecdfb71df4e994d759ffd475b0f0dcf89212ea781826f8b80b92dcf8c78d5851

php-ldap-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: a2817d5f4451bf3223d22139d70470a78684eb02caf4d863a38437b43e51a8d6

php-mbstring-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: c6cdaab2ca52cdcb2aa64294fcb7b7e92b95182a0bc94a39aeb48571d1cb9b3a

php-mbstring-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 77989104e63d7101e1057906dc7d763cff80484c9ba1267df2f6e9a60eb53c0d

php-mysqlnd-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: ae0230e11eaaef547e20867f8c8712b9f61e2800e5a326e9ffd0f88846c1d712

php-mysqlnd-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: ddb51691c8c55bde6cea89e42dac05eb79b4cb2c73465f3f97ff0e9207311f75

php-odbc-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: d02bb9397e5d6309ba0e285a4713e09b737bc77acb5a2d34555780adb19f1348

php-odbc-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 6d66a908e6095703bc7d74ac85ee7ffee76b36a42b32075db469d52576f81934

php-opcache-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: b00093719ad71fd77048c5acc9db789fbfd48b75786eb69fc98054120796dd0a

php-opcache-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 93a9ad9b730828ecf034fd92b620ce39592d07fe5a2eb4292178c387113fb594

php-pdo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 2e67b5a895dc07fd43f141e75d9ad773dc635435022dfec977cfb6d5c409bfba

php-pdo-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: d0870d78d4b1ea54545ce88f20f1394febc02595227dc64afb5f8c009850b141

php-pear-1.10.13-1.module+el8.4.0+16578+ed65e99e.noarch.rpm

SHA-256: dbe1067e48eab03afe6a399d9c22fe84cb3f3dc2ad30b477ec3335d62c32bd21

php-pecl-apcu-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 29274b94942f49de9c97e12a0998fb4b7f69c9cd03cb9e0b2033c548550cbc77

php-pecl-apcu-debuginfo-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 28c8a225fe0d4a75ea3901b2df4d4153310c1bb36140d3f3887c9921a1b8aa73

php-pecl-apcu-debugsource-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: ab10f5783192ab58c2cf32bc6ef6fb574224ebb3dafe32fafb94353a23581774

php-pecl-apcu-devel-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 56638437cbcee9779bb17923c2dfa349b8e1876afe97bd087b5acad45645577a

php-pecl-rrd-2.0.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 9c7d61cb1af7c7d4cb306c8fcf19377702c17d8889305d85d3da692635f22325

php-pecl-rrd-debuginfo-2.0.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: d7b9b9ea3d9ef10563159f7e4c4a93831b038751bba86a1af83397abe436bfb8

php-pecl-rrd-debugsource-2.0.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: b049012e9baeba02b55412972f1b3ab1fde443e785e34473bff755106524610d

php-pecl-xdebug-2.9.5-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: b889f21c8930e6eea3eed52006e9496a34112ed954507563ada7e6418910654f

php-pecl-xdebug-debuginfo-2.9.5-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 20ad52dc5c8eec57abaff761f7b7a19df898e51f7482fdfe0c833bae518f6ada

php-pecl-xdebug-debugsource-2.9.5-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: c066d810e464e36485b4ecc2b3b717dcecb9b86739e5dea88919e1a599b627a6

php-pecl-zip-1.18.2-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 9ad689763cec0d6379ed9efc9e5038b248ff65b6cd70ade588b064658af27c65

php-pecl-zip-debuginfo-1.18.2-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: bfb82456adc2289c4f382acf6bbe460fe997836009b4438d36679f882609c8fb

php-pecl-zip-debugsource-1.18.2-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 82238df0ed28b45f5c64e01858bd04a5eb59202b14425a3a323c86f967e7e090

php-pgsql-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 62cfe8fc161320745a899a6a4586184809beda130d2efc9f427e5fae71f4593d

php-pgsql-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 86cb851f4a6a6ace5bb3607055520255f54b0e413628258701814e44d8a693e9

php-process-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 8e4164b9b46f99a7960431cd902e5e2eb031b57ba835cbb30f7b00612189134b

php-process-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 83b95fe756c58520113f93d2d655ec0f84d6dbc76b9d8e421134c94a0da89ba3

php-snmp-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 71b7ae062627858be04218ffb44b96362907d4228e218c5e160bd9c8ba3af022

php-snmp-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 9068b144fce00faf6648f2e42000b6a2f0db2db93821e47d59eaa64ce8bc29ca

php-soap-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 9bd9a8c2f6625969144409780393c47cbd2f76fcfcb5cbc632533d999f35b1df

php-soap-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 5e8ed62a52620be5b05b60fffc833008c4032106ea20f59fb8def6772a0126e0

php-xml-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 1d4387abce4e4c7d2a1cd212768ec62d16bfd78c04b6ae15d2aee2e4fefd1895

php-xml-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 990692fde5f169dff64489ea905bd61af24c620b55e5fc3df4bdbd727ef2735a

php-xmlrpc-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: a6d0428d52f0aa1a1b8c085ca3faf3c0334971143347cc78d9f09e14cb9b0b44

php-xmlrpc-debuginfo-7.4.6-5.module+el8.4.0+15727+276bb227.x86_64.rpm

SHA-256: 241389f344eb24794e014ba6c21d3c67c534dd9d6f11d85ce793cfcea190bbbb

Red Hat Enterprise Linux Server - AUS 8.4