Описание
Security update for php72
This update for php72 fixes the following issues:
- CVE-2020-7069: Fixed an issue when AES-CCM mode was used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV was used (bsc#1177351).
- CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352).
- Added tmpfiles.d for php-fpm to provide a base for a socket (bsc#1173786)
Список пакетов
SUSE Linux Enterprise Module for Web and Scripting 12
apache2-mod_php72-7.2.5-1.54.1
php72-7.2.5-1.54.1
php72-bcmath-7.2.5-1.54.1
php72-bz2-7.2.5-1.54.1
php72-calendar-7.2.5-1.54.1
php72-ctype-7.2.5-1.54.1
php72-curl-7.2.5-1.54.1
php72-dba-7.2.5-1.54.1
php72-dom-7.2.5-1.54.1
php72-enchant-7.2.5-1.54.1
php72-exif-7.2.5-1.54.1
php72-fastcgi-7.2.5-1.54.1
php72-fileinfo-7.2.5-1.54.1
php72-fpm-7.2.5-1.54.1
php72-ftp-7.2.5-1.54.1
php72-gd-7.2.5-1.54.1
php72-gettext-7.2.5-1.54.1
php72-gmp-7.2.5-1.54.1
php72-iconv-7.2.5-1.54.1
php72-imap-7.2.5-1.54.1
php72-intl-7.2.5-1.54.1
php72-json-7.2.5-1.54.1
php72-ldap-7.2.5-1.54.1
php72-mbstring-7.2.5-1.54.1
php72-mysql-7.2.5-1.54.1
php72-odbc-7.2.5-1.54.1
php72-opcache-7.2.5-1.54.1
php72-openssl-7.2.5-1.54.1
php72-pcntl-7.2.5-1.54.1
php72-pdo-7.2.5-1.54.1
php72-pear-7.2.5-1.54.1
php72-pear-Archive_Tar-7.2.5-1.54.1
php72-pgsql-7.2.5-1.54.1
php72-phar-7.2.5-1.54.1
php72-posix-7.2.5-1.54.1
php72-pspell-7.2.5-1.54.1
php72-readline-7.2.5-1.54.1
php72-shmop-7.2.5-1.54.1
php72-snmp-7.2.5-1.54.1
php72-soap-7.2.5-1.54.1
php72-sockets-7.2.5-1.54.1
php72-sodium-7.2.5-1.54.1
php72-sqlite-7.2.5-1.54.1
php72-sysvmsg-7.2.5-1.54.1
php72-sysvsem-7.2.5-1.54.1
php72-sysvshm-7.2.5-1.54.1
php72-tidy-7.2.5-1.54.1
php72-tokenizer-7.2.5-1.54.1
php72-wddx-7.2.5-1.54.1
php72-xmlreader-7.2.5-1.54.1
php72-xmlrpc-7.2.5-1.54.1
php72-xmlwriter-7.2.5-1.54.1
php72-xsl-7.2.5-1.54.1
php72-zip-7.2.5-1.54.1
php72-zlib-7.2.5-1.54.1
SUSE Linux Enterprise Software Development Kit 12 SP5
php72-devel-7.2.5-1.54.1
Ссылки
- Link for SUSE-SU-2020:2943-1
- E-Mail link for SUSE-SU-2020:2943-1
- SUSE Security Ratings
- SUSE Bug 1173786
- SUSE Bug 1177351
- SUSE Bug 1177352
- SUSE CVE CVE-2020-7069 page
- SUSE CVE CVE-2020-7070 page
Описание
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.54.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.54.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.54.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.54.1
Ссылки
- CVE-2020-7069
- SUSE Bug 1177351
Описание
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.54.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.54.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.54.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.54.1
Ссылки
- CVE-2020-7070
- SUSE Bug 1177352