RedHat: RHSA-2020-0322:01 Critical: php:7.2 security update

    Date 03 Feb 2020
    477
    Posted By LinuxSecurity Advisories
    An update for the php:7.2 module is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Critical: php:7.2 security update
    Advisory ID:       RHSA-2020:0322-01
    Product:           Red Hat Enterprise Linux
    Advisory URL:      https://access.redhat.com/errata/RHSA-2020:0322
    Issue date:        2020-02-03
    CVE Names:         CVE-2019-11043 
    =====================================================================
    
    1. Summary:
    
    An update for the php:7.2 module is now available for Red Hat Enterprise
    Linux 8.0 Update Services for SAP Solutions.
    
    Red Hat Product Security has rated this update as having a security impact
    of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
    gives a detailed severity rating, is available for each vulnerability from
    the CVE link(s) in the References section.
    
    2. Relevant releases/architectures:
    
    Red Hat Enterprise Linux AppStream E4S (v. 8.0) - noarch, ppc64le, x86_64
    
    3. Description:
    
    PHP is an HTML-embedded scripting language commonly used with the Apache
    HTTP Server.
    
    Security Fix(es):
    
    * php: underflow in env_path_info in fpm_main.c (CVE-2019-11043)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, acknowledgments, and other related information, refer to the CVE
    page(s) listed in the References section.
    
    4. Solution:
    
    For details on how to apply this update, which includes the changes
    described in this advisory, refer to:
    
    https://access.redhat.com/articles/11258
    
    After installing the updated packages, the httpd daemon must be restarted
    for the update to take effect.
    
    5. Bugs fixed (https://bugzilla.redhat.com/):
    
    1766378 - CVE-2019-11043 php: underflow in env_path_info in fpm_main.c
    
    6. Package List:
    
    Red Hat Enterprise Linux AppStream E4S (v. 8.0):
    
    Source:
    libzip-1.5.1-1.module+el8+2561+1aca3413.src.rpm
    php-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.src.rpm
    php-pear-1.10.5-8.module+el8+2561+1aca3413.src.rpm
    php-pecl-apcu-5.1.12-1.module+el8+2561+1aca3413.src.rpm
    php-pecl-zip-1.15.3-1.module+el8+2561+1aca3413.src.rpm
    
    noarch:
    apcu-panel-5.1.12-1.module+el8+2561+1aca3413.noarch.rpm
    php-pear-1.10.5-8.module+el8+2561+1aca3413.noarch.rpm
    
    ppc64le:
    libzip-1.5.1-1.module+el8+2561+1aca3413.ppc64le.rpm
    libzip-debuginfo-1.5.1-1.module+el8+2561+1aca3413.ppc64le.rpm
    libzip-debugsource-1.5.1-1.module+el8+2561+1aca3413.ppc64le.rpm
    libzip-devel-1.5.1-1.module+el8+2561+1aca3413.ppc64le.rpm
    libzip-tools-1.5.1-1.module+el8+2561+1aca3413.ppc64le.rpm
    libzip-tools-debuginfo-1.5.1-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-bcmath-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-bcmath-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-cli-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-cli-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-common-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-common-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-dba-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-dba-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-dbg-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-dbg-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-debugsource-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-devel-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-embedded-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-embedded-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-enchant-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-enchant-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-fpm-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-fpm-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-gd-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-gd-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-gmp-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-gmp-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-intl-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-intl-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-json-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-json-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-ldap-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-ldap-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-mbstring-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-mbstring-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-mysqlnd-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-mysqlnd-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-odbc-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-odbc-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-opcache-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-opcache-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-pdo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-pdo-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-pecl-apcu-5.1.12-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pecl-apcu-debuginfo-5.1.12-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pecl-apcu-debugsource-5.1.12-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pecl-apcu-devel-5.1.12-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pecl-zip-1.15.3-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pecl-zip-debuginfo-1.15.3-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pecl-zip-debugsource-1.15.3-1.module+el8+2561+1aca3413.ppc64le.rpm
    php-pgsql-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-pgsql-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-process-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-process-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-recode-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-recode-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-snmp-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-snmp-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-soap-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-soap-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-xml-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-xml-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-xmlrpc-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    php-xmlrpc-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.ppc64le.rpm
    
    x86_64:
    libzip-1.5.1-1.module+el8+2561+1aca3413.x86_64.rpm
    libzip-debuginfo-1.5.1-1.module+el8+2561+1aca3413.x86_64.rpm
    libzip-debugsource-1.5.1-1.module+el8+2561+1aca3413.x86_64.rpm
    libzip-devel-1.5.1-1.module+el8+2561+1aca3413.x86_64.rpm
    libzip-tools-1.5.1-1.module+el8+2561+1aca3413.x86_64.rpm
    libzip-tools-debuginfo-1.5.1-1.module+el8+2561+1aca3413.x86_64.rpm
    php-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-bcmath-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-bcmath-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-cli-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-cli-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-common-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-common-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-dba-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-dba-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-dbg-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-dbg-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-debugsource-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-devel-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-embedded-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-embedded-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-enchant-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-enchant-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-fpm-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-fpm-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-gd-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-gd-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-gmp-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-gmp-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-intl-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-intl-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-json-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-json-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-ldap-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-ldap-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-mbstring-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-mbstring-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-mysqlnd-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-mysqlnd-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-odbc-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-odbc-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-opcache-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-opcache-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-pdo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-pdo-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-pecl-apcu-5.1.12-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pecl-apcu-debuginfo-5.1.12-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pecl-apcu-debugsource-5.1.12-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pecl-apcu-devel-5.1.12-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pecl-zip-1.15.3-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pecl-zip-debuginfo-1.15.3-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pecl-zip-debugsource-1.15.3-1.module+el8+2561+1aca3413.x86_64.rpm
    php-pgsql-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-pgsql-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-process-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-process-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-recode-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-recode-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-snmp-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-snmp-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-soap-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-soap-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-xml-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-xml-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-xmlrpc-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    php-xmlrpc-debuginfo-7.2.11-1.1.module+el8.0.0+4664+17bd8d65.x86_64.rpm
    
    These packages are GPG signed by Red Hat for security.  Our key and
    details on how to verify the signature are available from
    https://access.redhat.com/security/team/key/
    
    7. References:
    
    https://access.redhat.com/security/cve/CVE-2019-11043
    https://access.redhat.com/security/updates/classification/#critical
    
    8. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2020 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXjiQo9zjgjWX9erEAQifGQ/+OGCw/MIhZ+bEPP/iO58IlyT0S1waIJkQ
    H6akm08d2dZQAy0zIRLrObqAEnJvZyO5itxAv+n+vaBPxTEaizKSDtZHaljXKfPZ
    07HA78m3gcTDp9zWQlfTblZ6weclUEPDP436qlDbH9olU/spKi5x5fDe3VPN1Oc+
    EMEfRE2eFrBluyphcjBD8SNmPokyrOOZ1qQdTSpjS7O5y0NhJ2KtpItWh10dZQ/9
    3WNWQeXfWqogCO7psQ8R2lcQ1IEIpOnIpC65yhuaYvlaU+4MmMVi3Hto6X4GDSlX
    nrRgB5sT1AcDc0OwNSJZ5qThxvdhxASIyX1Sb2GAuZNHiQOPgikKvmBA2E0zDGg5
    bXXkDjZrkKE8VFo5SsRhT/BpwpyC+GLalNs9OylyDITyYWUcVJfy3KajqX81htSA
    FL2AAUAOcu4cB7jGNplMzo5mfLhaSjkeK7JwOmY+NgsqBeX4bi4inE6R/uG6eWin
    bMYGF94Yhzy7/hr71G6/444Z+ZSvcf897zy9d7xqjNCPzf/uU/js5PZFTR1zdS9A
    X2msIzEWs0AHl44HyKETigL/CbdbwFayIOwTmtc4IZ5IuvbNGPUKz/jOqJ05FDXm
    xQ9gsOwuK0HJR96e6IKc0Pv822o45qP9gH7o/7hEBMZsB9w2913Jq4zf+2eR7aGs
    6OVDGFDpWXI=
    =MiBv
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    

    LinuxSecurity Poll

    How do you feel about the elimination of the terms 'blacklist' and 'slave' from the Linux kernel?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/32-how-do-you-feel-about-the-elimination-of-the-terms-blacklist-and-slave-from-the-linux-kernel?task=poll.vote&format=json
    32
    radio
    [{"id":"112","title":"I strongly support this change - racially charged language should not be used in the code and documentation of the kernel and other open-source projects.","votes":"3","type":"x","order":"1","pct":42.86,"resources":[]},{"id":"113","title":"I'm indifferent - this small change will not affect broader issues of racial insensitivity and white privilege.","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"114","title":"I'm opposed to this change - there is no need to change language that has been used for years. It doesn't make sense for people to take offense to terminology used in community projects.","votes":"2","type":"x","order":"3","pct":28.57,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.