Red Hat Security Advisory: php security update

Moderate

An improper input validation vulnerability was found in PHP. Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser.

CWE-20 - Improper Input Validation

A null byte interaction error vulnerability was found in PHP. If a password stored with password_hash starts with a null byte (\x00), testing a blank string as the password via password_verify will incorrectly return true. If a user can create a password with a leading null byte (unlikely, but syntactically valid), an attacker could trivially compromise the victim's account by attempting to sign in with a blank string.

CWE-626 - Null Byte Interaction Error (Poison Null Byte)

A flaw was found in PHP. An early return in the filter_var (FILTER_VALIDATE_URL) function results in invalid user information (username + password part of URLs) being treated as valid user information. This issue impacts users who expect only completely valid URLs to be returned by filter_var (FILTER_VALIDATE_URL). As this function is used to validate user-supplied strings, this issue exposes raw user input often.

CWE-20 - Improper Input Validation

A flaw was found in PHP's parsing of multipart form data contents, which affects both file and input form data. This may lead to legitimate data not being processed, violating data integrity. For example, if a multipart form data payload contains a valid prefix 'X' of the defined boundary B such that 5Kib < |X| < |B| < 8Kib, the logic responsible for parsing and storing the multipart payload fails to correctly extract the contents between two boundaries.

CWE-1286 - Improper Validation of Syntactic Correctness of Input