RHSA-2023:5926HighCVSS 7.5

Red Hat Security Advisory: php security update

Published
October 19, 2023
Last Modified
August 6, 2026

🔗 CVE IDs covered (6)

CVE-2023-3823 →CVE-2023-3824 →CVE-2023-0567 →CVE-2023-0568 →CVE-2023-0662 →CVE-2023-3247 →

📋 Description

CVE-2023-0567 — php: Password_verify() always return true with some hash CVE-2023-0568 — php: 1-byte array overrun in common path resolve code CVE-2023-0662 — php: DoS vulnerability when parsing multipart request body CVE-2023-3247 — php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP CVE-2023-3823 — php: XML loading external entity without being enabled CVE-2023-3824 — php: phar Buffer mismanagement

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 9)
  • php-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-0:8.0.30-1.el9_2.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-debuginfo-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-debuginfo-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-debuginfo-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-bcmath-debuginfo-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-debuginfo-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-debuginfo-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-debuginfo-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-cli-debuginfo-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-debuginfo-0:8.0.30-1.el9_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-debuginfo-0:8.0.30-1.el9_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-debuginfo-0:8.0.30-1.el9_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • php-common-debuginfo-0:8.0.30-1.el9_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon must be restarted for the update to take effect. Workaround: Users can decrease the post_max_size close to zero. This will render most websites non-interactive and break file uploads. Workaround: To avoid XML external entity attacks, either disable external entity loading if it's not necessary for your application or change the default external entity loader by using `libxml_set_external_entity_loader`. This can be used to suppress the expansion of arbitrary external entities. For PHP versions prior to 8.0, the following should be set when using the default PHP XML parser in order to prevent XXE: https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php

🔗 References (9)