==========================================================================
Ubuntu Security Notice USN-4583-2
October 27, 2020

php7.4 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.10

Summary:

Several security issues were fixed in PHP.

Software Description:
– php7.4: server-side, HTML-embedded scripting language (metapackage)

Details:

USN-4583-1 fixed vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 20.10.

Original advisory details:

It was discovered that PHP incorrectly handled certain encrypt ciphers.
An attacker could possibly use this issue to decrease security or cause
incorrect encryption data. (CVE-2020-7069)

It was discorevered that PHP incorrectly handled certain HTTP cookies.
An attacker could possibly use this issue to forge cookie which is supposed to
be secure. (CVE-2020-7070)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
libapache2-mod-php7.4 7.4.9-1ubuntu1.1
php7.4-cgi 7.4.9-1ubuntu1.1
php7.4-cli 7.4.9-1ubuntu1.1
php7.4-curl 7.4.9-1ubuntu1.1
php7.4-fpm 7.4.9-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4583-2
https://usn.ubuntu.com/4583-1
CVE-2020-7069, CVE-2020-7070

Package Information:
https://launchpad.net/ubuntu/+source/php7.4/7.4.9-1ubuntu1.1
—–BEGIN PGP SIGNATURE—–

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAl+YJgcACgkQRbznW4QL
H2mTTA//ZFoMr/zYOG1r7BAhDDLjOeGmSw8dJEbdI57xufDHvk8v2QGUbR7fQPDi
u8wSERBip3dcGOzClAb9Kog1GMDqXLLqNsaO8mfNXNiVuCacuspQCRJELOoxIro4
m8hSKL0UOnG8Bde86AKRrEUxlq+bOpFs4BYkQZQ87owJ7CakeQTSBxpc7M0EwWdT
iKRYXBtWLuZpLrFwv1G5avITFKS8lDk+uOUZ6jJmoTFbjk08rdqMAod2qWyhEEEG
hl7CimntoatszJYAS8OKQhgCHA83UarUh4kWeW3NeR3dlzloyBeXhAuLu3ldzIGh
qvriyTwIJgjS6zYHoFQoIqg9MdQ8TnXSLO1JBhPpVv8QVsjebpTHJwMPZq4+wsdS
e6/msulFAbd/UFRA9NGvIbpcnRM4qppo9wY6NmYSJRHXkK32z0CXMGBQ7l0wY9QZ
b4YrQJt8WL/q80Hu5+fBj9ActJWHrk7ibWMC+zFXA7adbYu9d15F5rbs6frkcLE9
VyYbtDNj3vQH4jXx7lNkn1pxQd3oKtaUWbLept8NQL89EUI4wknBtxRMZPnm05ZM
DM8A1+24VJgp86ry1dAKt7FJ0paYiWwW6l2k7Eyt0jAhni0nqZ+/4ffNthNQ89lK
NyOjPdyVRa9FSUKc9uAlj4RneAcvVWTdJDa0pJENK3101X+dWC0=
=c0Ct
—–END PGP SIGNATURE—–
—