Moderate: php:8.2 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096) * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458) * php: Erroneous parsing of multipart form data (CVE-2024-8925) * php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927) * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096) * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458) * php: Erroneous parsing of multipart form data (CVE-2024-8925) * php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927) * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
05 / REFERENCES
Further evidence
- https://access.redhat.com/errata/RHSA-2024:10949
- https://access.redhat.com/security/cve/CVE-2024-2756
- https://access.redhat.com/security/cve/CVE-2024-3096
- https://access.redhat.com/security/cve/CVE-2024-5458
- https://access.redhat.com/security/cve/CVE-2024-8925
- https://access.redhat.com/security/cve/CVE-2024-8927
- https://access.redhat.com/security/cve/CVE-2024-9026
- https://bugzilla.redhat.com/2275058
- https://bugzilla.redhat.com/2275061
- https://bugzilla.redhat.com/2291252
- https://bugzilla.redhat.com/2317049
- https://bugzilla.redhat.com/2317051
- https://bugzilla.redhat.com/2317144
- https://errata.almalinux.org/9/ALSA-2024-10949.html