According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21     and 7.4.x below 7.4.9, while processing PHAR files     using phar extension, phar_parse_zipfile could be     tricked into accessing freed memory, which could lead     to a crash or information disclosure.(CVE-2020-7068)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23     and 7.4.x below 7.4.11, when PHP is processing incoming     HTTP cookie values, the cookie names are url-decoded.
    This may lead to cookies with prefixes like __Host     confused with cookies that decode to such prefix, thus     leading to an attacker being able to forge cookie which     is supposed to be secure. See also CVE-2020-8184 for     more information.(CVE-2020-7070)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23     and 7.4.x below 7.4.11, when AES-CCM mode is used with     openssl_encrypt() function with 12 bytes IV, only first     7 bytes of the IV is actually used. This can lead to     both decreased security and incorrect encryption     data.(CVE-2020-7069)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14     and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept     an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to     mis-parse the URL and produce wrong data as components     of the URL.(CVE-2020-7071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

EulerOS Virtualization for ARM 64 3.0.6.0 : php (EulerOS-SA-2021-1566)

medium Nessus Plugin ID 147033

No changelogs found