Headline

RHSA-2022:6542: Red Hat Security Advisory: php:7.4 security update

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2020-28948: Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
CVE-2020-28949: Archive_Tar: improper filename sanitization leads to file overwrites
CVE-2020-36193: Archive_Tar: directory traversal due to inadequate checking of symbolic links

2 years ago

Red Hat Security Data

Open in Source

#sql #vulnerability #linux #red_hat #apache #js #php #ldap #ibm #sap

Synopsis

Moderate: php:7.4 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the php:7.4 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948)
Archive_Tar: improper filename sanitization leads to file overwrites (CVE-2020-28949)
Archive_Tar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Affected Products

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
Red Hat Enterprise Linux Server - AUS 8.6 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
Red Hat Enterprise Linux Server - TUS 8.6 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

BZ - 1904001 - CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
BZ - 1910323 - CVE-2020-28949 Archive_Tar: improper filename sanitization leads to file overwrites
BZ - 1942961 - CVE-2020-36193 Archive_Tar: directory traversal due to inadequate checking of symbolic links

Red Hat Enterprise Linux for x86_64 8

SRPM

libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: ab8126b34de0337c40aa9165a671f01c387fa0f619f07cb007145d20a8059626

php-7.4.19-4.module+el8.6.0+16316+906f6c6d.src.rpm

SHA-256: f9ba573d6cbb2d76cdfa69c6c2f0348220504c5a03f79ef1c31537624161e75d

php-pear-1.10.13-1.module+el8.6.0+16577+0788886f.src.rpm

SHA-256: ff9405aae9814394edea90e703741707878312f7fd1889ab5f0b092a54925f01

php-pecl-apcu-5.1.18-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 5ef846d350d101cc5ade15412bd9a11c4939dce0d664556a45c7b388d54958dc

php-pecl-rrd-2.0.1-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 2c0dda676d2975cec816811a305cad43d1177f7064cb4f729d6febccceaf1bed

php-pecl-xdebug-2.9.5-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 6cefdd897b02f017aa7f36bb1be5141ccde8baefd17f2e8af1c751315fa48057

php-pecl-zip-1.18.2-1.module+el8.3.0+6678+b09f589e.src.rpm

SHA-256: 37aa20b43d46ed37c3d11d64253a9be57307db957ac2de5cf0382f37e2200fd1

x86_64

apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch.rpm

SHA-256: 969124a440bc9018b5ccbf36175195f803908a47e3850e5203922a624b563955

libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 909a4e2bfc39b47266aae1b0e7d50c237ba7f94a6d4c1334e82fa39467fe77da

libzip-debuginfo-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 5b4b202ac79aef3b8000e6e30f966b46bb4aa6aed78ced7657ab4eb5a82cad2a

libzip-debugsource-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 46397c3fe3f18a86771ffd19bda42c704f542c87bc474c37d2e274bf9405d200

libzip-devel-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 190a912a533e67dd94974263dbf311586a0c6b8e80ec8d469e1e93f901881162

libzip-tools-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 94028a5413773f56c98f3f0b4e220a16c0d91c6726fbea08dea26618df3cd9eb

libzip-tools-debuginfo-1.6.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 99d5e36d9f94cd6d547176727902ac01f7e341d42e4f575a1461ef6242ccbfb3

php-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: c92b891bfbcdff185741817acc94e18d47f2f32a9fd951005aca2f6fa12e33ac

php-bcmath-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: e547f299db20eb6dc9f77a0ee5130f14f9a330f64adaa0ba5589a02bc2815be3

php-bcmath-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: ff39f4994089139e47d6cc015bb42d0133e78485215ad4d59383ff2304561c95

php-cli-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: b9178abd633a407631ff5cdb6f00403bba64ab7cec42bb7b887f6859533a1fd9

php-cli-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 00d7a4b7ea422832281c2db70f9222d1ddeb190e1f2ac73c55ab5a792cd217de

php-common-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: bb5686c727a8bec741e189f0e78c1a8f245b4bf43bdeaf3b64518ec0f7425006

php-common-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: c8fddba0c10fbe8cfc931731d8b0c077ff38e71f2ce1eff10e4ebadfa4c2b0d9

php-dba-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: b80f8e35fdf7854f4232997fb60a08aca0c7dcba8c7504b9ebd64fa656236a90

php-dba-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: c4f21b374a369ba664ecae9983dfb5aacf8aaa8a1ac26ae317ba1e3e35681845

php-dbg-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 0ca03e5480296c6c6d4c9d6fd352d50e2200dcd10d08726ccf56cee97ff37637

php-dbg-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 568723fe08dfbc2fd38e6bd936e5e793ee477e53f97dc6ecb58606ffcc0f031f

php-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: e31d688be7b053b5ec28b868689b3b65affe5e2307fd1058f5b5346615cdb851

php-debugsource-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 072f9717738230e8f9c265099cbf01597115c118e8ad3cad8214243667f106ed

php-devel-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 7151db27ab6b64089fcef27799fbd7e2bcf9d886605d53b679c33ba2fb773d1f

php-embedded-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 759310f39ef212474488a75eda72df12961051e9f17175dda6cd56b22ac5e9a2

php-embedded-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: fc48b2ab0a763ccf0f076b8804765da2ffebfcefa13068e3c8592b06afed1eb5

php-enchant-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 877b1b983c43ecae9aebc6388e8fb11248e047faada78309675034d1dda403d2

php-enchant-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: a15f794665a29ce652a921fc7a5f26814938d7abf3ad7e2e5f2a0c678b830823

php-ffi-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 27d67f83c77a4c1e1a9790985d9c52d7138d6d9bae509236183a2c96cf057e13

php-ffi-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: ea743ea3372286b85bc48cb7addf9789ff80ba05660f4fdd882603b182a6462e

php-fpm-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: e252c1dd6559267d279524d6f5c9a6b8bd4d697346253366fdf9acba3eee9975

php-fpm-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 9b0d0ec4b31b679b15fa97c5e8b25311e3f791f26b8e5739a95e31fb14493ffe

php-gd-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: c0c413afadb24e5210d979f4c173f855e8976cca88989a3657ac1e0d6f549ae0

php-gd-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 9d6512dc244b25d326bf6b1980e99bd193ad1c98bdfadf6e7ac213479400cdae

php-gmp-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 21c72ed4bdd0af6d55f5d1d7e8f05d8593795b27ceb5aae52d0bad6ed121ac38

php-gmp-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: ef36a1f3874830b579bc426fd0d194b9ea6a5eb1e74ce01f14dcb2038be25d68

php-intl-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: ba6ea4dfa855d2dfe8efa9aa1933269d1d788473dc9c3adcbeeb49bae95f5a20

php-intl-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 2f149f9b460136f667bbe889a5bdb2c5f80a63aea54014e2c800fda8345e622b

php-json-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: f4a23faf165fc9cc2e0071e983fa65ae224aa36a4be942cd97407104a64f3a45

php-json-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 05eb611f4804e0b43c8b3624e5af52afb1323c2f6d904e852a702ef94e7432b2

php-ldap-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 26c1661d7d37c3a8f5620fa0cda77fbdabf277cc1b80934ad5c259400eee3bc7

php-ldap-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 3b26162afeef58803265e723813d073317b0512692c3a1b7842ff705923aff85

php-mbstring-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 14e5c7d57c40ea359365dc97716bc49dd6191f40c61722c7f7d95e8e5972c3b2

php-mbstring-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 766d81957f1eb487d0758d66e7c106c2a1cc0c4a46617ea36d0c49b8122b2de7

php-mysqlnd-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: b417fbb20d08058e0d36d61395cbcad774da1608f9d8ffcc5c6cb036a2f46fca

php-mysqlnd-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 1597bf4c04ccf7696b4b2f520ac246450a5f86e75440f156bd42a30877cc7290

php-odbc-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 6663bf804f8991524a222b506a976ea19d53404731476aa4112578c67b2a7c6c

php-odbc-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: c0a5ceb6ee65bdd0d0da321ec4e02278045870260baea1e1f0f52601095b0ce1

php-opcache-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: f38710309c493b0ea3992c407228e0e8a381f6fbefbed6058a87a72238f3595b

php-opcache-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 92fd4bda0eeb3ddee5e60c0f9121ba00e9b68f7b2c7638c9c8b9f0bdf36b97db

php-pdo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 537364b077fdcb48de2519e6a7571226b3807e81cdf08eef5be601cd03ac6be3

php-pdo-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: a77936ad92c4cdd14c626050408651126ba37348f894c1b5458b4fd3b1f48edd

php-pear-1.10.13-1.module+el8.6.0+16577+0788886f.noarch.rpm

SHA-256: ff90d7cdf666225b789774ff88c8e574a1009fa5455d135d0e257082d7e6b984

php-pecl-apcu-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 29274b94942f49de9c97e12a0998fb4b7f69c9cd03cb9e0b2033c548550cbc77

php-pecl-apcu-debuginfo-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 28c8a225fe0d4a75ea3901b2df4d4153310c1bb36140d3f3887c9921a1b8aa73

php-pecl-apcu-debugsource-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: ab10f5783192ab58c2cf32bc6ef6fb574224ebb3dafe32fafb94353a23581774

php-pecl-apcu-devel-5.1.18-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 56638437cbcee9779bb17923c2dfa349b8e1876afe97bd087b5acad45645577a

php-pecl-rrd-2.0.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 9c7d61cb1af7c7d4cb306c8fcf19377702c17d8889305d85d3da692635f22325

php-pecl-rrd-debuginfo-2.0.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: d7b9b9ea3d9ef10563159f7e4c4a93831b038751bba86a1af83397abe436bfb8

php-pecl-rrd-debugsource-2.0.1-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: b049012e9baeba02b55412972f1b3ab1fde443e785e34473bff755106524610d

php-pecl-xdebug-2.9.5-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: b889f21c8930e6eea3eed52006e9496a34112ed954507563ada7e6418910654f

php-pecl-xdebug-debuginfo-2.9.5-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 20ad52dc5c8eec57abaff761f7b7a19df898e51f7482fdfe0c833bae518f6ada

php-pecl-xdebug-debugsource-2.9.5-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: c066d810e464e36485b4ecc2b3b717dcecb9b86739e5dea88919e1a599b627a6

php-pecl-zip-1.18.2-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 9ad689763cec0d6379ed9efc9e5038b248ff65b6cd70ade588b064658af27c65

php-pecl-zip-debuginfo-1.18.2-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: bfb82456adc2289c4f382acf6bbe460fe997836009b4438d36679f882609c8fb

php-pecl-zip-debugsource-1.18.2-1.module+el8.3.0+6678+b09f589e.x86_64.rpm

SHA-256: 82238df0ed28b45f5c64e01858bd04a5eb59202b14425a3a323c86f967e7e090

php-pgsql-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 1a5899348c35866fb65953f0457711cdacaed1d9237c6a4941cfa6b27f3a0f92

php-pgsql-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 01d887dc16cbf16a66fa30c5de90c16dc9ed25d150710371a7bcfedf221a3585

php-process-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 712a039733555a81cc77d9370f0275b6753d5e60d4c9c1dfcd896cc7187756bf

php-process-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: a4745272518c811642e1cc4760acaf6de0f0bb2c8f971fe9edc8390cdb804f2a

php-snmp-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 79dd72ce56ee531ecf3ecc5228bbab9ec0ce1b062ef2e0f8025e09f81740e6bb

php-snmp-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 9d4c286c3a3d685bd7280dae40c5e62d6d460737ccc513b1a14490a03f066fb8

php-soap-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 06ce790a1d56738d77c05160712192390a730afeda06dc3ab60f459a92c8541e

php-soap-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 2046301859b27fad0e157bd4fdd0318f2bc220e9834e07cf20013b3bd3341b58

php-xml-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 5d1a580087985443c2ad39fb32308e471e4088463a13469d7b11d3969580faa8

php-xml-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 8036c17996706f764e2dca00563533ea872f5ebf71a9a617c417dc27549070a5

php-xmlrpc-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: 8814fc44cee20687f996e54aa67b71112eb3b85bbb3720c1ae12dead083b7e1e

php-xmlrpc-debuginfo-7.4.19-4.module+el8.6.0+16316+906f6c6d.x86_64.rpm

SHA-256: a1634631480553683aef849dd16c68e41f7dfb05ebc033e6f40ebad91b1a9f86

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6