Linux · Security advisory · September 16, 2022

ELSA-2022-6542: Security update for 37 packages

ELSA-2022-6542, released September 16, 2022, fixes 3 CVEs across 37 products. 2 of them are being exploited (CVE-2020-28949); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
3
None rated Critical
Exploited
2
CVE-2020-28949
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.8455
99th percentile

Priority of the 3 CVEs

Patch now 2 Urgent 0 High 1 Routine 0

Fixed package versions

ProductReleaseFixed in
apcu-panelol 80:5.1.18-1.module+el8.3.0+7685+72d70b58
libzipol 80:1.6.1-1.module+el8.3.0+7685+72d70b58
libzip-develol 80:1.6.1-1.module+el8.3.0+7685+72d70b58
libzip-toolsol 80:1.6.1-1.module+el8.3.0+7685+72d70b58
phpol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-bcmathol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-cliol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-commonol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-dbaol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-dbgol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-develol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-embeddedol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-enchantol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-ffiol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-fpmol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-gdol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-gmpol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-intlol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-jsonol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-ldapol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-mbstringol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-mysqlndol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-odbcol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-opcacheol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-pdool 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-pearol 81:1.10.13-1.module+el8.6.0+20746+7a133c42
php-pecl-apcuol 80:5.1.18-1.module+el8.3.0+7685+72d70b58
php-pecl-apcu-develol 80:5.1.18-1.module+el8.3.0+7685+72d70b58
php-pecl-rrdol 80:2.0.1-1.module+el8.3.0+7685+72d70b58
php-pecl-xdebugol 80:2.9.5-1.module+el8.3.0+7685+72d70b58
php-pecl-zipol 80:1.18.2-1.module+el8.3.0+7685+72d70b58
php-pgsqlol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-processol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-snmpol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-soapol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-xmlol 80:7.4.19-4.module+el8.6.0+20746+7a133c42
php-xmlrpcol 80:7.4.19-4.module+el8.6.0+20746+7a133c42

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2020-28949 php-pear: Archive_Tar through 1.4.10 has :// filename sanitization only to addressphar attacks, and thus any other stream-wrapp... 7.8 0.8455 KEVExploited
Patch now CVE-2020-36193 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * Archive_T... 7.8 0.7060 KEVExploited
High CVE-2020-28948 php-pear: Archive_Tar through 1.4.10 allows an unserialization attack because phar:is blocked but PHAR: is not blocked. 7.8 0.4749 None reported
Showing 1 to 3 of 3 1