Moderate: php:8.1 security update

2024-01-2400:00:00

errata.almalinux.org

php

apache http server

security fix

dos vulnerability

multipart request body

http digest authentication

xml loading

buffer mismanagement

password_verify()

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.4%

JSON

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

php: 1-byte array overrun in common path resolve code (CVE-2023-0568)
php: DoS vulnerability when parsing multipart request body (CVE-2023-0662)
php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247)
php: XML loading external entity without being enabled (CVE-2023-3823)
php: phar Buffer mismanagement (CVE-2023-3824)
php: Password_verify() always return true with some hash (CVE-2023-0567)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux9noarchapcu-panel< 5.1.21-1.module_el9.1.0+15+94ba28e4apcu-panel-5.1.21-1.module_el9.1.0+15+94ba28e4.noarch.rpm
almalinux9ppc64lephp-intl< 8.1.27-1.module_el9.3.0+53+44872dd1php-intl-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp-enchant< 8.1.27-1.module_el9.3.0+53+44872dd1php-enchant-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp-ldap< 8.1.27-1.module_el9.3.0+53+44872dd1php-ldap-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp-pecl-zip< 1.20.1-1.module_el9.1.0+15+94ba28e4php-pecl-zip-1.20.1-1.module_el9.1.0+15+94ba28e4.ppc64le.rpm
almalinux9ppc64lephp-cli< 8.1.27-1.module_el9.3.0+53+44872dd1php-cli-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp-pgsql< 8.1.27-1.module_el9.3.0+53+44872dd1php-pgsql-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp-gd< 8.1.27-1.module_el9.3.0+53+44872dd1php-gd-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp-ffi< 8.1.27-1.module_el9.3.0+53+44872dd1php-ffi-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux9ppc64lephp< 8.1.27-1.module_el9.3.0+53+44872dd1php-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	9	noarch	apcu-panel	< 5.1.21-1.module_el9.1.0+15+94ba28e4	apcu-panel-5.1.21-1.module_el9.1.0+15+94ba28e4.noarch.rpm
almalinux	9	ppc64le	php-intl	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-intl-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php-enchant	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-enchant-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php-ldap	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-ldap-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php-pecl-zip	< 1.20.1-1.module_el9.1.0+15+94ba28e4	php-pecl-zip-1.20.1-1.module_el9.1.0+15+94ba28e4.ppc64le.rpm
almalinux	9	ppc64le	php-cli	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-cli-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php-pgsql	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-pgsql-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php-gd	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-gd-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php-ffi	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-ffi-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm
almalinux	9	ppc64le	php	< 8.1.27-1.module_el9.3.0+53+44872dd1	php-8.1.27-1.module_el9.3.0+53+44872dd1.ppc64le.rpm