Read the docs
Red Hat Security Advisory

RHSA-2022:5491

rh-php73-php security and bug fix update

Released 2022-07-04 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2022-13550 CVE-2022-31626 · GHSA-jfc6-9gw3-fhfg

mysqlnd/pdo password buffer overflow

Priority HIGH 72

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.58123 Published 2022-06-16 Fixed in 7.4.30, 8.0.20 +1 CWE-120
TI-2021-04787 CVE-2021-21707 · GHSA-qh78-qfw9-93x9

Special characters break path parsing in XML functions

Priority MEDIUM 45

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.25315 Published 2021-11-29 Partial fix · 7.3.33, 7.4.26 +1 CWE-159
TI-2022-13549 CVE-2022-31625 · GHSA-wg63-8xjw-5wvx

Freeing unallocated memory in php_pgsql_free_params()

Priority MEDIUM 42

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory usin…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0379 Published 2022-06-16 Fixed in 7.4.30, 8.0.20 +1 CWE-590
TI-2021-04783 CVE-2021-21703 · GHSA-h8qx-36w6-3rc4

PHP-FPM memory access in root process leading to privilege escalation

Priority LOW 37

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged u…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01426 Published 2021-10-25 Partial fix · 7.4.25, 8.0.12 CWE-284