摘要:
php security update
安全等级: High
公告ID: KylinSec-SA-2024-4097
发布日期: 2025年2月8日
关联CVE: CVE-2024-9026 CVE-2024-8925 CVE-2024-8926 CVE-2024-8927
PHP 是一种嵌入在 HTML 中的脚本语言。PHP 试图让开发者能够轻松地编写动态生成的网页。PHP 还为多个商业和非商业数据库管理系统提供了内置的数据库集成，因此使用 PHP 编写启用了数据库的网页相当简单。PHP 编码最常见的用途可能是作为 CGI 脚本的替代品。php 包包含了一个模块（通常称为 mod_php），该模块在为 Apache HTTP Server 运行的预派生（prefork）模式下添加了对 PHP 语言的支持。%if 1 注意：此模块已被弃用。%endif
安全修复：
在 PHP 8.1.* 版本（8.1.30 之前）、8.2.* 版本（8.2.24 之前）和 8.3.* 版本（8.3.12 之前）中，对包含在 HTTP POST 请求中的多部分表单数据的错误解析可能导致合法数据无法被处理。这可能导致恶意攻击者能够控制提交数据的一部分，从而排除其他数据的部分，可能导致应用程序行为错误。(CVE-2024-8925)
在 PHP 8.1.* 版本（8.1.30 之前）、8.2.* 版本（8.2.24 之前）和 8.3.* 版本（8.3.12 之前）中，当使用 Windows 代码页的某些非标准配置时，针对 CVE-2024-4577（https://github.com/advisories/GHSA-vxpp-6299-mxw3）的修复仍可能被绕过，并且可以实现与 Windows “最佳匹配”代码页行为相关的相同命令注入。这可能会允许恶意用户向正在运行的 PHP 二进制文件传递选项，从而泄露脚本的源代码、在服务器上运行任意 PHP 代码等。(CVE-2024-8926)
在 PHP 8.1.* 版本（8.1.30 之前）、8.2.* 版本（8.2.24 之前）和 8.3.* 版本（8.3.12 之前）中，HTTP_REDIRECT_STATUS 变量用于检查 CGI 二进制文件是否由 HTTP 服务器运行。然而，在某些情况下，此变量的内容可以通过 HTTP 头由请求提交者控制，这可能导致 cgi.force_redirect 选项无法正确应用。在某些配置中，这可能导致在 PHP 中包含任意文件。(CVE-2024-8927)
在 PHP 8.1.* 版本（8.1.30 之前）、8.2.* 版本（8.2.24 之前）和 8.3.* 版本（8.3.12 之前）中，当使用 PHP-FPM SAPI 并且配置为通过 catch_workers_output = yes 捕获工作进程输出时，通过操作日志消息内容，可能会污染最终日志或从日志消息中删除最多 4 个字符。此外，如果 PHP-FPM 配置为使用 syslog 输出，则可能利用相同的漏洞进一步删除日志数据。(CVE-2024-9026)
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2024-9026 | KY3.4-5 | php | Fixed |
| CVE-2024-9026 | KY3.5.2 | php | Fixed |
| CVE-2024-9026 | KY3.5.3 | php | Fixed |
| CVE-2024-9026 | V6 | php | Fixed |
| CVE-2024-8925 | KY3.4-5 | php | Fixed |
| CVE-2024-8925 | KY3.5.2 | php | Fixed |
| CVE-2024-8925 | KY3.5.3 | php | Fixed |
| CVE-2024-8925 | V6 | php | Fixed |
| CVE-2024-8926 | KY3.4-5 | php | Fixed |
| CVE-2024-8926 | KY3.5.2 | php | Fixed |
| CVE-2024-8926 | KY3.5.3 | php | Fixed |
| CVE-2024-8926 | V6 | php | Fixed |
| CVE-2024-8927 | KY3.4-5 | php | Fixed |
| CVE-2024-8927 | KY3.5.2 | php | Fixed |
| CVE-2024-8927 | KY3.5.3 | php | Fixed |
| CVE-2024-8927 | V6 | php | Fixed |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| php | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-bcmath | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-cli | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-common | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-dba | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-dbg | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-devel | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-embedded | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-enchant | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-ffi | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-fpm | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-gd | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-gmp | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-help | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-intl | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-ldap | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-mbstring | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-mysqlnd | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-odbc | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-opcache | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-pdo | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-pgsql | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-process | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-snmp | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-soap | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-sodium | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-tidy | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php-xml | x86_64 | 8.0.30-6.kb1.ky3_4 |
| php | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-bcmath | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-cli | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-common | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-dba | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-dbg | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-devel | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-embedded | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-enchant | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-ffi | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-fpm | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-gd | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-gmp | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-help | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-intl | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-ldap | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-mbstring | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-mysqlnd | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-odbc | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-opcache | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-pdo | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-pgsql | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-process | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-snmp | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-soap | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-sodium | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-tidy | aarch64 | 8.0.30-6.kb1.ky3_4 |
| php-xml | aarch64 | 8.0.30-6.kb1.ky3_4 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| php | x86_64 | 8.3.14-1.ks6 |
| php-bcmath | x86_64 | 8.3.14-1.ks6 |
| php-cli | x86_64 | 8.3.14-1.ks6 |
| php-common | x86_64 | 8.3.14-1.ks6 |
| php-dba | x86_64 | 8.3.14-1.ks6 |
| php-dbg | x86_64 | 8.3.14-1.ks6 |
| php-devel | x86_64 | 8.3.14-1.ks6 |
| php-embedded | x86_64 | 8.3.14-1.ks6 |
| php-enchant | x86_64 | 8.3.14-1.ks6 |
| php-ffi | x86_64 | 8.3.14-1.ks6 |
| php-fpm | x86_64 | 8.3.14-1.ks6 |
| php-gd | x86_64 | 8.3.14-1.ks6 |
| php-gmp | x86_64 | 8.3.14-1.ks6 |
| php-help | x86_64 | 8.3.14-1.ks6 |
| php-intl | x86_64 | 8.3.14-1.ks6 |
| php-ldap | x86_64 | 8.3.14-1.ks6 |
| php-mbstring | x86_64 | 8.3.14-1.ks6 |
| php-mysqlnd | x86_64 | 8.3.14-1.ks6 |
| php-odbc | x86_64 | 8.3.14-1.ks6 |
| php-opcache | x86_64 | 8.3.14-1.ks6 |
| php-pdo | x86_64 | 8.3.14-1.ks6 |
| php-pgsql | x86_64 | 8.3.14-1.ks6 |
| php-process | x86_64 | 8.3.14-1.ks6 |
| php-snmp | x86_64 | 8.3.14-1.ks6 |
| php-soap | x86_64 | 8.3.14-1.ks6 |
| php-sodium | x86_64 | 8.3.14-1.ks6 |
| php-tidy | x86_64 | 8.3.14-1.ks6 |
| php-xml | x86_64 | 8.3.14-1.ks6 |
| php | aarch64 | 8.3.14-1.ks6 |
| php-bcmath | aarch64 | 8.3.14-1.ks6 |
| php-cli | aarch64 | 8.3.14-1.ks6 |
| php-common | aarch64 | 8.3.14-1.ks6 |
| php-dba | aarch64 | 8.3.14-1.ks6 |
| php-dbg | aarch64 | 8.3.14-1.ks6 |
| php-devel | aarch64 | 8.3.14-1.ks6 |
| php-embedded | aarch64 | 8.3.14-1.ks6 |
| php-enchant | aarch64 | 8.3.14-1.ks6 |
| php-ffi | aarch64 | 8.3.14-1.ks6 |
| php-fpm | aarch64 | 8.3.14-1.ks6 |
| php-gd | aarch64 | 8.3.14-1.ks6 |
| php-gmp | aarch64 | 8.3.14-1.ks6 |
| php-help | aarch64 | 8.3.14-1.ks6 |
| php-intl | aarch64 | 8.3.14-1.ks6 |
| php-ldap | aarch64 | 8.3.14-1.ks6 |
| php-mbstring | aarch64 | 8.3.14-1.ks6 |
| php-mysqlnd | aarch64 | 8.3.14-1.ks6 |
| php-odbc | aarch64 | 8.3.14-1.ks6 |
| php-opcache | aarch64 | 8.3.14-1.ks6 |
| php-pdo | aarch64 | 8.3.14-1.ks6 |
| php-pgsql | aarch64 | 8.3.14-1.ks6 |
| php-process | aarch64 | 8.3.14-1.ks6 |
| php-snmp | aarch64 | 8.3.14-1.ks6 |
| php-soap | aarch64 | 8.3.14-1.ks6 |
| php-sodium | aarch64 | 8.3.14-1.ks6 |
| php-tidy | aarch64 | 8.3.14-1.ks6 |
| php-xml | aarch64 | 8.3.14-1.ks6 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| php | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-bcmath | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-cli | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-common | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-dba | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-dbg | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-devel | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-embedded | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-enchant | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-ffi | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-fpm | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-gd | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-gmp | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-help | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-intl | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-ldap | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-mbstring | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-mysqlnd | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-odbc | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-opcache | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-pdo | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-pgsql | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-process | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-snmp | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-soap | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-sodium | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-tidy | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-xml | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-bcmath | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-cli | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-common | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-dba | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-dbg | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-devel | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-embedded | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-enchant | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-ffi | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-fpm | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-gd | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-gmp | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-help | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-intl | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-ldap | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-mbstring | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-mysqlnd | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-odbc | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-opcache | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-pdo | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-pgsql | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-process | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-snmp | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-soap | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-sodium | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-tidy | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-xml | aarch64 | 8.0.30-6.ky3_5.kb1 |
| 软件名称 | 架构 | 版本号 |
|---|---|---|
| php | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-bcmath | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-cli | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-common | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-dba | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-dbg | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-devel | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-embedded | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-enchant | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-ffi | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-fpm | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-gd | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-gmp | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-help | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-intl | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-ldap | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-mbstring | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-mysqlnd | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-odbc | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-opcache | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-pdo | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-pgsql | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-process | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-snmp | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-soap | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-sodium | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-tidy | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php-xml | x86_64 | 8.0.30-6.ky3_5.kb1 |
| php | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-bcmath | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-cli | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-common | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-dba | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-dbg | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-devel | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-embedded | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-enchant | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-ffi | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-fpm | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-gd | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-gmp | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-help | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-intl | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-ldap | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-mbstring | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-mysqlnd | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-odbc | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-opcache | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-pdo | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-pgsql | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-process | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-snmp | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-soap | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-sodium | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-tidy | aarch64 | 8.0.30-6.ky3_5.kb1 |
| php-xml | aarch64 | 8.0.30-6.ky3_5.kb1 |
方法一：下载安装包进行升级安装
1、通过下载链接下载需要升级的升级包保存，如 xxx.rpm
2、通过rpm命令升级，如 rpm -Uvh xxx.rpm
方法二：通过软件源进行升级安装
1、保持能够连接上互联网
2、通过yum命令升级指定的包，如 yum install 包名
