Bug 877853 – <dev-lang/php-{7.4.33,8.0.25,8.1.12}: multiple vulnerabilities

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2022-10-21 16:05:54 UTC]

CVE-2022-37454:

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

URL says PHP is affected, any fix or report upstream?

[Comment 1 Brian Evans (RETIRED) 2022-10-21 22:18:29 UTC]

Will be fixed in the next release

[Comment 2 John Helmert III 2022-10-22 04:40:38 UTC]

Thanks!

[Comment 3 Larry the Git Cow 2022-10-28 18:22:19 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=933e9dbff1dade86d2492c6a6f18dbc69f70caed

commit 933e9dbff1dade86d2492c6a6f18dbc69f70caed
Author:     Brian Evans <[e-mail]>
AuthorDate: 2022-10-28 18:20:34 +0000
Commit:     Brian Evans <[e-mail]>
CommitDate: 2022-10-28 18:22:16 +0000

    dev-lang/php: Version bump for 8.1.12
    
    Bug: https://bugs.gentoo.org/877853
    Bug: https://bugs.gentoo.org/878133
    Signed-off-by: Brian Evans <[e-mail]>

 dev-lang/php/Manifest          |   1 +
 dev-lang/php/php-8.1.12.ebuild | 757 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 758 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7f2e081926e4380728f98037cda3e3b7aaf4410f

commit 7f2e081926e4380728f98037cda3e3b7aaf4410f
Author:     Brian Evans <[e-mail]>
AuthorDate: 2022-10-28 17:47:34 +0000
Commit:     Brian Evans <[e-mail]>
CommitDate: 2022-10-28 18:22:16 +0000

    dev-lang/php: Version bump for 8.0.25
    
    Bug: https://bugs.gentoo.org/877853
    Bug: https://bugs.gentoo.org/878133
    Signed-off-by: Brian Evans <[e-mail]>

 dev-lang/php/Manifest          |   1 +
 dev-lang/php/php-8.0.25.ebuild | 759 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 760 insertions(+)

[Comment 4 John Helmert III 2022-10-30 03:33:37 UTC]

Thanks! Please stabilize when ready. Do we know if 7.4 is affected?

[Comment 5 Brian Evans (RETIRED) 2022-10-30 12:32:15 UTC]

(In reply to John Helmert III from comment #4)
> Thanks! Please stabilize when ready. Do we know if 7.4 is affected?

Yes this was applied to the 7.4 branch.  I will wait a few days for a release before localizing these patches into a revbump.

[Comment 6 Larry the Git Cow 2022-11-03 13:02:36 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d9788a266bffae184d77b33abfb39cd38003be75

commit d9788a266bffae184d77b33abfb39cd38003be75
Author:     Brian Evans <[e-mail]>
AuthorDate: 2022-11-03 13:01:49 +0000
Commit:     Brian Evans <[e-mail]>
CommitDate: 2022-11-03 13:02:14 +0000

    dev-lang/php: Version bump for 7.4.33
    
    Bug: https://bugs.gentoo.org/877853
    Signed-off-by: Brian Evans <[e-mail]>

 dev-lang/php/Manifest          |   1 +
 dev-lang/php/php-7.4.33.ebuild | 749 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 750 insertions(+)

[Comment 7 Larry the Git Cow 2022-11-18 16:12:07 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=782bbfabc6969db4a521238fa5e5bdc6c295e942

commit 782bbfabc6969db4a521238fa5e5bdc6c295e942
Author:     Brian Evans <[e-mail]>
AuthorDate: 2022-11-18 16:10:27 +0000
Commit:     Brian Evans <[e-mail]>
CommitDate: 2022-11-18 16:10:27 +0000

    dev-lang/php: Drop old versions
    
    Bug: https://bugs.gentoo.org/877853
    Signed-off-by: Brian Evans <[e-mail]>

 dev-lang/php/Manifest          |   3 -
 dev-lang/php/php-7.4.32.ebuild | 748 ----------------------------------------
 dev-lang/php/php-8.0.24.ebuild | 758 -----------------------------------------
 dev-lang/php/php-8.1.11.ebuild | 756 ----------------------------------------
 4 files changed, 2265 deletions(-)

[Comment 8 John Helmert III 2022-11-18 21:15:48 UTC]

Added to existing GLSA request.

[Comment 9 Larry the Git Cow 2022-11-22 04:01:23 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a1c6623b6eaf15e917c58aa4f27b51911625e28f

commit a1c6623b6eaf15e917c58aa4f27b51911625e28f
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-11-19 03:32:18 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-11-22 03:59:39 +0000

    [ GLSA 202211-03 ] PHP: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/867913
    Bug: https://bugs.gentoo.org/873376
    Bug: https://bugs.gentoo.org/877853
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202211-03.xml | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

[Comment 10 John Helmert III 2022-11-22 04:03:14 UTC]

GLSA released, all done!