REDHAT-BUG-1808536: Medium severity php vulnerability
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.
Reference: https://bugs.php.net/bug.php?id=79082
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1808536?
The vulnerability REDHAT-BUG-1808536 is classified as a medium severity issue due to improper file permissions.
How do I fix REDHAT-BUG-1808536?
To mitigate REDHAT-BUG-1808536, upgrade PHP to version 7.2.28, 7.3.15, or 7.4.3 or later.
What versions of PHP are affected by REDHAT-BUG-1808536?
PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15, and 7.4.x below 7.4.3 are affected by REDHAT-BUG-1808536.
What issues can REDHAT-BUG-1808536 cause in applications?
REDHAT-BUG-1808536 can lead to security risks as files are created with overly permissive default settings.
Is there a public discussion about REDHAT-BUG-1808536?
Yes, REDHAT-BUG-1808536 has been discussed in public forums, specifically on the PHP bug tracker.