Detections
Analytics

Amazon Linux AMI : php72, php73 (ALAS-2020-1425)

low Nessus Plugin ID 148126

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

The version of php72 installed on the remote host is prior to 7.2.33-1.25. The version of php73 installed on the remote host is prior to 7.3.21-1.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1425 advisory.

 - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure. (CVE-2020-7068)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update php72' to update your system.
 Run 'yum update php73' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2020-1425.html

https://access.redhat.com/security/cve/CVE-2020-7068

Plugin Details

Severity: Low

ID: 148126

File Name: ala_ALAS-2020-1425.nasl

Version: 1.3

Type: local

Agent: unix

Published: 3/25/2021

Updated: 1/8/2024

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.6

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2020-7068

CVSS v3

Risk Factor: Low

Base Score: 3.6

Temporal Score: 3.3

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:php72-xmlrpc, p-cpe:/a:amazon:linux:php73-mbstring, p-cpe:/a:amazon:linux:php72-json, p-cpe:/a:amazon:linux:php72-process, p-cpe:/a:amazon:linux:php73-ldap, p-cpe:/a:amazon:linux:php73-dbg, p-cpe:/a:amazon:linux:php73-pgsql, p-cpe:/a:amazon:linux:php73-pdo, p-cpe:/a:amazon:linux:php73-intl, p-cpe:/a:amazon:linux:php72-dba, p-cpe:/a:amazon:linux:php73-debuginfo, p-cpe:/a:amazon:linux:php73-json, p-cpe:/a:amazon:linux:php73-odbc, p-cpe:/a:amazon:linux:php73-opcache, p-cpe:/a:amazon:linux:php73-pspell, p-cpe:/a:amazon:linux:php73-dba, p-cpe:/a:amazon:linux:php73-tidy, p-cpe:/a:amazon:linux:php73-snmp, p-cpe:/a:amazon:linux:php72, p-cpe:/a:amazon:linux:php72-ldap, p-cpe:/a:amazon:linux:php73-common, p-cpe:/a:amazon:linux:php73-recode, p-cpe:/a:amazon:linux:php72-tidy, p-cpe:/a:amazon:linux:php72-mbstring, p-cpe:/a:amazon:linux:php72-common, p-cpe:/a:amazon:linux:php72-recode, p-cpe:/a:amazon:linux:php73-xml, p-cpe:/a:amazon:linux:php72-fpm, p-cpe:/a:amazon:linux:php73, p-cpe:/a:amazon:linux:php73-soap, p-cpe:/a:amazon:linux:php72-mysqlnd, p-cpe:/a:amazon:linux:php72-intl, p-cpe:/a:amazon:linux:php73-bcmath, p-cpe:/a:amazon:linux:php72-cli, p-cpe:/a:amazon:linux:php72-imap, p-cpe:/a:amazon:linux:php72-gd, p-cpe:/a:amazon:linux:php72-opcache, p-cpe:/a:amazon:linux:php72-pgsql, p-cpe:/a:amazon:linux:php73-xmlrpc, p-cpe:/a:amazon:linux:php73-gmp, p-cpe:/a:amazon:linux:php73-devel, p-cpe:/a:amazon:linux:php72-odbc, p-cpe:/a:amazon:linux:php73-cli, p-cpe:/a:amazon:linux:php72-pspell, p-cpe:/a:amazon:linux:php72-snmp, p-cpe:/a:amazon:linux:php72-dbg, p-cpe:/a:amazon:linux:php72-xml, p-cpe:/a:amazon:linux:php73-gd, cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:php72-enchant, p-cpe:/a:amazon:linux:php72-embedded, p-cpe:/a:amazon:linux:php72-gmp, p-cpe:/a:amazon:linux:php72-pdo, p-cpe:/a:amazon:linux:php72-soap, p-cpe:/a:amazon:linux:php72-pdo-dblib, p-cpe:/a:amazon:linux:php73-fpm, p-cpe:/a:amazon:linux:php72-bcmath, p-cpe:/a:amazon:linux:php73-mysqlnd, p-cpe:/a:amazon:linux:php73-pdo-dblib, p-cpe:/a:amazon:linux:php73-process, p-cpe:/a:amazon:linux:php72-devel, p-cpe:/a:amazon:linux:php73-embedded, p-cpe:/a:amazon:linux:php73-enchant, p-cpe:/a:amazon:linux:php73-imap, p-cpe:/a:amazon:linux:php72-debuginfo

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/26/2020

Vulnerability Publication Date: 8/13/2020

Reference Information

CVE: CVE-2020-7068

ALAS: 2020-1425