Linux · AlmaLinux · Security advisory · September 15, 2022

ALSA-2022:6542: Security update for 37 packages

ALSA-2022:6542, released September 15, 2022, fixes 3 CVEs across 37 products. 2 of them are being exploited (CVE-2020-28949); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
3
None rated Critical
Exploited
2
CVE-2020-28949
Highest CVSS
7.8
Base score, 0 to 10
Highest EPSS
0.8455
99th percentile

Priority of the 3 CVEs

Patch now 2 Urgent 0 High 1 Routine 0

Fixed package versions

ProductReleaseFixed in
apcu-panelalmalinux 85.1.18-1.module_el8.6.0+2750+78feabcb
libzipalmalinux 81.6.1-1.module_el8.6.0+2750+78feabcb
libzip-develalmalinux 81.6.1-1.module_el8.6.0+2750+78feabcb
libzip-toolsalmalinux 81.6.1-1.module_el8.6.0+3239+bedf0508
phpalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-bcmathalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-clialmalinux 87.4.19-4.module_el8.6.0+3239+bedf0508
php-commonalmalinux 87.4.19-4.module_el8.6.0+3239+bedf0508
php-dbaalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-dbgalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-develalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-embeddedalmalinux 87.4.19-4.module_el8.6.0+3239+bedf0508
php-enchantalmalinux 87.4.19-4.module_el8.6.0+3239+bedf0508
php-ffialmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-fpmalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-gdalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-gmpalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-intlalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-jsonalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-ldapalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-mbstringalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-mysqlndalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-odbcalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-opcachealmalinux 87.4.19-4.module_el8.6.0+3239+bedf0508
php-pdoalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-pearalmalinux 81:1.10.13-1.module_el8.6.0+3268+b150a051
php-pecl-apcualmalinux 85.1.18-1.module_el8.6.0+2750+78feabcb
php-pecl-apcu-develalmalinux 85.1.18-1.module_el8.6.0+3239+bedf0508
php-pecl-rrdalmalinux 82.0.1-1.module_el8.6.0+2750+78feabcb
php-pecl-xdebugalmalinux 82.9.5-1.module_el8.6.0+3239+bedf0508
php-pecl-zipalmalinux 81.18.2-1.module_el8.6.0+2750+78feabcb
php-pgsqlalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-processalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-snmpalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-soapalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-xmlalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8
php-xmlrpcalmalinux 87.4.19-4.module_el8.6.0+3238+624bf8b8

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2020-28949 php-pear: Archive_Tar through 1.4.10 has :// filename sanitization only to addressphar attacks, and thus any other stream-wrapp...7.8 0.8455 KEVExploited
Patch now CVE-2020-36193 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * Archive_T...7.8 0.7060 KEVExploited
High CVE-2020-28948 php-pear: Archive_Tar through 1.4.10 allows an unserialization attack because phar:is blocked but PHAR: is not blocked.7.8 0.4749 None reported
Showing 1 to 3 of 3 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.