Linux · Red Hat · Security advisory · September 15, 2022

RHSA-2022:6542: Security update for 37 packages

RHSA-2022:6542, released September 15, 2022, fixes 3 CVEs across 37 products. 2 of them are being exploited (CVE-2020-28949); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEV
CVEs closed
3
None rated Critical
Exploited
2
CVE-2020-28949
Highest CVSS
7.8
Base score, 0 to 10
Highest EPSS
0.8455
99th percentile

Priority of the 3 CVEs

Patch now 2 Urgent 0 High 1 Routine 0

Fixed package versions

ProductReleaseFixed in
apcu-panelRHEL 80:5.1.18-1.module+el8.3.0+6678+b09f589e
libzipRHEL 80:1.6.1-1.module+el8.3.0+6678+b09f589e
libzip-develRHEL 80:1.6.1-1.module+el8.3.0+6678+b09f589e
libzip-toolsRHEL 80:1.6.1-1.module+el8.3.0+6678+b09f589e
phpRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-bcmathRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-cliRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-commonRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-dbaRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-dbgRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-develRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-embeddedRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-enchantRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-ffiRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-fpmRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-gdRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-gmpRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-intlRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-jsonRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-ldapRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-mbstringRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-mysqlndRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-odbcRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-opcacheRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-pdoRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-pearRHEL 81:1.10.13-1.module+el8.6.0+16577+0788886f
php-pecl-apcuRHEL 80:5.1.18-1.module+el8.3.0+6678+b09f589e
php-pecl-apcu-develRHEL 80:5.1.18-1.module+el8.3.0+6678+b09f589e
php-pecl-rrdRHEL 80:2.0.1-1.module+el8.3.0+6678+b09f589e
php-pecl-xdebugRHEL 80:2.9.5-1.module+el8.3.0+6678+b09f589e
php-pecl-zipRHEL 80:1.18.2-1.module+el8.3.0+6678+b09f589e
php-pgsqlRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-processRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-snmpRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-soapRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-xmlRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d
php-xmlrpcRHEL 80:7.4.19-4.module+el8.6.0+16316+906f6c6d

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2020-28949 php-pear: Archive_Tar through 1.4.10 has :// filename sanitization only to addressphar attacks, and thus any other stream-wrapp...7.8 0.8455 KEVExploited
Patch now CVE-2020-36193 apcu-panel: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * Archive_T...7.8 0.7060 KEVExploited
High CVE-2020-28948 php-pear: Archive_Tar through 1.4.10 allows an unserialization attack because phar:is blocked but PHAR: is not blocked.7.8 0.4749 None reported
Showing 1 to 3 of 3 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.