This Red Hat security advisory covers a set of moderate-impact vulnerabilities in the PHP 8.2 module used in Red Hat Enterprise Linux 9. The fixed issues include CVE-2024-2756 (host/secure cookie bypass due to a partial fix of a previous vulnerability), CVE-2024-3096 (password_verify function erroneously returning true, risking account takeover), CVE-2024-5458 (filter bypass in filter_var with FILTER_VALIDATE_URL), CVE-2024-8925 (erroneous parsing of multipart form data), CVE-2024-8927 (bypass of cgi.force_redirect configuration via environment variable collision), and CVE-2024-9026 (PHP-FPM log manipulation vulnerability). Additional related vulnerabilities are also addressed in the update. Red Hat has provided patches for these issues in the PHP 8.2.25 update for RHEL 9, covering multiple architectures and extended update support versions.

The vulnerabilities collectively could allow attackers to bypass security controls such as cookie protections, cause incorrect authentication results leading to potential account takeover, bypass URL validation filters, manipulate multipart form data processing, circumvent CGI redirect protections, and manipulate PHP-FPM logs. These issues could undermine application security and potentially lead to unauthorized access or information disclosure. However, no known exploits in the wild have been reported. The overall severity is rated as moderate by Red Hat.

A patch is available and should be applied promptly. Red Hat has released updated PHP 8.2 packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Administrators should follow the official Red Hat guidance at https://access.redhat.com/articles/11258 to update affected systems. No additional mitigation steps are indicated beyond applying the official update.