Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 6 Jun 2024 17:04:53 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: PHP security releases 8.3.8, 8.2.20, and 8.1.29

In https://fosstodon.org/@php/112570710411472992 it is written:

> Announcing the availability of:
> 
> - PHP 8.3.8
> - PHP 8.2.20
> - PHP 8.1.29
> 
> ‼️ These SECURITY releases fix:
> 
> - Argument Injection in PHP-CGI
> - Bypass in filter_var FILTER_VALIDATE_URL
> - proc_open workaround Windows with escaping arguments for bat/cmd files
> - openssl_private_decrypt vulnerability to the Marvin attack
> 
> Please upgrade ASAP.
> 
> Changelog: https://www.php.net/ChangeLog-8.php
> Source: https://www.php.net/downloads

The Changelog link includes further details:

  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection
    in PHP-CGI). (CVE-2024-4577)

  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var
    FILTER_VALIDATE_URL). (CVE-2024-5458)

  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)

  - The openssl_private_decrypt function in PHP, when using PKCS1 padding
    (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the
    Marvin Attack unless it is used with an OpenSSL version that includes
    the changes from this pull request:
        https://github.com/openssl/openssl/pull/13817
    (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2
    and have also been backported to stable versions of various Linux
    distributions, as well as to the PHP builds provided for Windows since
    the previous release. All distributors and builders should ensure that
    this version is used to prevent PHP from being vulnerable.

Unfortunately the related advisories don't seem to be published yet under those
GHSA id's on https://github.com/php/php-src/security .

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.