RHSA-2022:7340: Moderate: php-pear security update
The php-pear package contains the PHP Extension and Application Repository (PEAR), a framework and distribution system for reusable PHP components.Security Fix(es): ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked (CVE-2020-28948) ArchiveTar: improper filename sanitization leads to file overwrites (CVE-2020-28949) ArchiveTar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:7340?
RHSA-2022:7340 has been classified as a high severity vulnerability due to the potential for unserialization attacks.
What software is affected by RHSA-2022:7340?
The vulnerability affects the php-pear package in versions prior to 1.9.4-23.el7_9.
How do I fix RHSA-2022:7340?
To fix RHSA-2022:7340, you should update the php-pear package to version 1.9.4-23.el7_9 or later.
What type of attack does RHSA-2022:7340 allow?
RHSA-2022:7340 allows for an unserialization attack due to the improper handling of PHAR files.
Is there a workaround for RHSA-2022:7340?
There are currently no known workarounds for RHSA-2022:7340, so updating the package is the recommended approach.